Skill Claude CodeCodex
Use whenever code touches authentication, login, session management, audit logging, or application logging — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Triggers on bcrypt/argon2/scrypt, jsonwebtoken/jose, passport/next-auth/Auth.js/authjs/lucia, express-session/iron-session…
Skill Claude CodeCodex
Use whenever code touches newsletter, marketing-email, drip-campaign, re-engagement, win-back, lead-magnet, or any outbound email with promotional content — even if the user's prompt doesn't mention DSGVO, GDPR, UWG, privacy, or "personal data". Triggers on Mailchimp / @mailchimp/mailchimpmarketing, Brevo /…
Skill Claude CodeCodex
Use whenever code or infrastructure handles user data and touches a non-EU service or region — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Any user data (names, emails, IPs, user IDs, avatars, profile pictures, uploaded files, user-generated content…
Cursor rule
Use whenever code generates or modifies marketing-email content with AI/LLM APIs (OpenAI openai / @openai/sdk, Anthropic @anthropic-ai/sdk, Mistral @mistralai/mistralai, Cohere cohere-ai, Vertex AI @google-cloud/vertexai, Azure OpenAI) — even if the user prompt only says "Subject-Line mit GPT generieren"…
Cursor rule
Use whenever code touches authentication, login, session management, audit logging, or application logging — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Triggers on bcrypt/argon2/scrypt, jsonwebtoken/jose, passport/next-auth/Auth.js/authjs/lucia, express-session/iron-session…
Cursor rule
DSGVO Auth-TOMs (Art. 32). Use when implementing or reviewing authentication code: password hashing parameters (bcrypt cost, argon2id memory/time), session timeouts, cookie flags (HttpOnly/Secure/SameSite), MFA enforcement (TOTP/WebAuthn), rate-limit values for login/password-reset/MFA-verify, refresh-token rotation.…
Cursor rule
Datensouveränität, Art. 48 DSGVO, US CLOUD Act, BCRs. Use whenever US/UK/CN-headquartered cloud providers host EU data — even in EU regions. Triggers on AWS, Azure, GCP, Cloudflare, Microsoft 365, Google Workspace in EU regions; questions about CLOUD Act risk, US lawful access, BYOK/HYOK, EU-souveräne Alternativen…
Cursor rule
DSGVO Datenschutz-Folgenabschätzung (DSFA / DPIA, Art. 35). Use when planning systems involving sensitive data (Art. 9 — health, biometric, etc.), large-scale tracking, profiling, automated decision-making, employee monitoring, KI/ML systems with personal data, KRITIS, or any processing on the German DSK Muss-Liste.…
Cursor rule
Use whenever code touches newsletter, marketing-email, drip-campaign, re-engagement, win-back, lead-magnet, or any outbound email with promotional content — even if the user's prompt doesn't mention DSGVO, GDPR, UWG, privacy, or "personal data". Triggers on Mailchimp / @mailchimp/mailchimpmarketing, Brevo /…
Cursor rule
Wenn ein Drittlandtransfer und ein Tracking-Tool gleichzeitig im Spiel sind, beide Regelwerke prüfen.
Cursor rule
DSGVO IP-Adressen sind personenbezogen (EuGH C-582/14 Breyer, BGH VI ZR 135/13). Use when code logs, stores, or processes IP addresses — req.ip, X-Forwarded-For, audit-log tables, brute-force/rate-limit counters, access logs. Covers IP truncation (/24 IPv4, /48 IPv6), HMAC-pseudonymization, X-Forwarded-For trust chain…
Cursor rule
Schweiz — revDSG, Swiss-US DPF, EDÖB. Use whenever Swiss users/customers are involved or a Swiss controller deploys US tools. Triggers on .ch domains, Schweizer Kunden, EDÖB, revDSG, Swiss-US Data Privacy Framework, FADP, Bundesgesetz über den Datenschutz, DSG, Art. 16-19 revDSG cross-border transfer rules, Schweizer…
Cursor rule
DSGVO Verantwortlichkeiten und Rollen (Art. 6, 9, 26, 28). Use when clarifying controller/processor/joint-controller relationships, drafting AVVs (Art. 28 DPA), handling Art. 9 sensitive data categories, joint-controller arrangements, sub-processor chains. Triggers on questions about Auftragsverarbeitung, DPA…
Cursor rule
Abgrenzung Service-Mail vs werbliche E-Mail nach BGH-/OLG-Linie (BGH I ZR 218/07 vom 20.05.2009 — „E-Mail-Werbung II" / B2B-Eingriff; VI ZR 225/17 vom 10.07.2018 — Bewertungsbitte = Werbung; VI ZR 134/15 vom 15.12.2015 — „No-Reply" / Auto-Reply mit Werbezusatz = Eingriff Persönlichkeitsrecht). Use when classifying…
Cursor rule
DSGVO Drittlandtransfer (Kapitel V, Art. 44-49). Use whenever code or infrastructure handles user data and touches a non-EU service or region — even if the user's prompt doesn't mention DSGVO/GDPR/privacy. Any user data (names, emails, IPs, user IDs, avatars, profile pictures, uploaded files, user-generated content…
Cursor rule
DSGVO Open-Tracking-Pixel, Click-Redirects und externe Bilder in Marketing-Mails. Use when implementing Mail-Open-Pixel (1x1.gif, /open?id=), Click-Tracking-Redirects (/c/ ?u=), externe CDN-Bilder im Mail-Template, Personalisierungs-/Profiling-Tracking, A/B-Tests pro Empfänger. Erfasst TDDDG § 25 als Norm (Wohnsitz…
Cursor rule
DSGVO One-Click-Unsubscribe (Art. 7 III + Art. 21 II + RFC 8058) und Aufbewahrungsfristen für Marketing-Mail. Use when implementing /unsubscribe-Endpoints, List-Unsubscribe + List-Unsubscribe-Post Header, Suppression-Hash-Schema, Bounce-Handling (hard/soft/spam-complaint), Re-Permission bei Inaktivität, Gmail/Yahoo…
Cursor rule
DSGVO + UWG-Lauterkeitsrecht für werbliche E-Mail in DACH. Use when discussing UWG § 7 (DE) inkl. § 7 II Nr. 3 + § 7 III Bestandskunden-Privileg-Voraussetzungen, AT TKG 2021 § 174, CH UWG Art. 3 I o, Cold-B2B-Mailing, LinkedIn-/XING-Plattform-DMs als elektronische Post (OLG Hamm 18 U 154/22 vom 03.05.2023)…