UK GDPR Assessment

Assess UK General Data Protection Regulation compliance for "$ARGUMENTS". Evaluate UK-specific divergences from EU GDPR, ICO requirements, and UK international transfer mechanisms.

Arguments. $ARGUMENTS may contain the project name and optional flags. Take the first token as <project> and treat --skip-checks as a flag; never include flags in file paths. All paths below use <project>. If --skip-checks is present, skip the prerequisite check and, before writing any artifact, append one line to .metapowers/compliance/<project>/skip-log.md: - <ISO timestamp> — <skill name> skipped prerequisite check for <artifact file> — reason: <reason or "none given">.

Prerequisites

Read .metapowers/compliance/<project>/00-scope.md. If this file does not exist, tell the user:

Phase 0 (Scope) has not been completed for "<project>". Run /compliance:regulatory-landscape <project> first, or use --skip-checks to bypass.

Process

1. Read context files:

   • Read ${CLAUDE_PLUGIN_ROOT}/shared/grc-lifecycle-guide.md for GRC methodology reference
   • Read ${CLAUDE_PLUGIN_ROOT}/shared/assessment-template.md for output structure
   • Read .metapowers/compliance/<project>/00-scope.md for scope and control framework context

2. UK GDPR applicability and divergences:

   • Assess whether UK GDPR applies (UK establishment, offering goods/services to UK, monitoring UK individuals)
   • Identify areas where UK GDPR diverges from EU GDPR
   • Review ICO as the supervisory authority and its enforcement approach
   • Assess dual compliance obligations if both EU and UK GDPR apply

3. Lawful basis and consent (UK approach):

   • Assess lawful basis per processing activity under UK GDPR
   • Evaluate UK-specific legitimate interest balancing test (ICO three-part test)
   • Review age of consent for information society services (13 in UK vs 16 in EU)
   • Assess Age Appropriate Design Code (Children's Code) applicability

4. International transfers (UK mechanisms):

   • Map all transfers outside the UK
   • Assess UK adequacy decisions (which countries have UK adequacy)
   • Evaluate UK International Data Transfer Agreement (IDTA) usage
   • Review UK addendum to EU Standard Contractual Clauses
   • Assess UK Transfer Risk Assessments (TRAs)
   • Evaluate transfers between UK and EEA (bridging provisions)

5. PECR (Privacy and Electronic Communications Regulations):

   • Assess cookie consent compliance (PECR requirements)
   • Evaluate direct marketing consent (email, SMS, phone)
   • Review electronic communication security obligations
   • Assess cookie banner implementation and consent mechanisms

6. UK-specific governance:

   • Assess DPO appointment under UK GDPR
   • Review ICO registration (data protection fee)
   • Evaluate UK representative appointment (if required for non-UK organizations)
   • Assess records of processing activities

7. Breach notification (UK requirements):

   • Assess breach notification to ICO (72 hours)
   • Evaluate data subject notification procedures
   • Review breach severity assessment aligned with ICO guidance
   • Check breach register maintenance

8. Write the artifact to .metapowers/compliance/<project>/01-assess/uk-gdpr.md following the assessment template structure with:

   • UK Applicability — territorial scope and dual compliance assessment
   • Divergence Analysis — UK vs EU GDPR differences with compliance impact
   • Lawful Basis Assessment — UK-specific approach including legitimate interest
   • Transfer Mechanisms — IDTA, UK addendum, adequacy, TRA status
   • PECR Compliance — cookies, direct marketing, electronic communications
   • ICO Governance — registration, DPO, representative requirements
   • Breach Readiness — ICO notification capability
   • Evidence Inventory — existing evidence and evidence gaps
   • Remediation Priorities — ranked list of gaps to address

Output

The UK GDPR assessment written to .metapowers/compliance/<project>/01-assess/uk-gdpr.md. Present a summary to the user highlighting:

• Overall UK GDPR compliance score — score = (Compliant + 0.5 × Partial) ÷ applicable requirements (N/A excluded), as a percentage
• Key divergences from EU GDPR requiring separate compliance effort
• PECR compliance status
• Top 3 gaps requiring remediation

End the artifact with this paragraph, verbatim:

Not legal or audit advice. This artifact supports preparation for compliance work; certification, attestation and regulatory conclusions require a qualified auditor or counsel.