Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add LeadMagic/gtm-skills --skill data-privacy-compliancegit clone --depth 1 https://github.com/LeadMagic/gtm-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/leadmagic/gtm-skills/data-privacy-compliance)<a href="https://agentmods.dev/skills/leadmagic/gtm-skills/data-privacy-compliance"><img src="https://agentmods.dev/badge/skills/leadmagic/gtm-skills/data-privacy-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/leadmagic/gtm-skills/data-privacy-compliance"><img src="https://agentmods.dev/badge/skills/leadmagic/gtm-skills/data-privacy-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.03253 |
| Opus 5 | $0.00073 | $0.01626 |
| Sonnet 5 | $0.00029 | $0.00651 |
| Haiku 4.5 | $0.00015 | $0.00325 |
Grade A, and why
data-privacy-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 283 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Privacy Compliance
Overview
Privacy compliance went from "nice to have" to "existential requirement." GDPR fines reach 4% of global annual revenue or €20M (whichever is higher). CCPA allows private lawsuits. Enterprise customers won't sign without a DPA and SCCs. The mistake: treating privacy as a legal checkbox instead of an operational program. This skill covers the complete privacy compliance roadmap for B2B SaaS: GDPR, CCPA, cookie consent, DPAs, SCCs, and building a privacy program that passes enterprise security reviews.
Authoritative Foundations
- GDPR (EU General Data Protection Regulation 2016/679) — Lawful basis, data minimization, DPA requirements for EU buyers.
- CCPA/CPRA (California Consumer Privacy Act / California Privacy Rights Act) — Shapes deliverables for this skill — Privacy compliance went from "nice to have" to "existential requirement.
- ePrivacy Directive (EU Cookie Law) — Shapes deliverables for this skill — Privacy compliance went from "nice to have" to "existential requirement.
- IAPP (International Association of Privacy Professionals) — Shapes deliverables for this skill — Privacy compliance went from "nice to have" to "existential requirement.
- NIST Privacy Framework — Shapes deliverables for this skill — Privacy compliance went from "nice to have" to "existential requirement.
- Termly / Iubenda — Privacy compliance tools — Privacy compliance tools
When to Use
Trigger phrases: "GDPR compliance", "CCPA requirements", "data privacy for SaaS", "cookie consent banner", "Data Processing Agreement", "Standard Contractual Clauses", "SCCs", "privacy by design", "data subject access request", "DPIA", "privacy program", "enterprise privacy requirements"
Step-by-Step Process
Phase 1: Privacy Law Scoping
Which laws apply to you?
| Law | Applies If | Key Requirements | Penalty |
|---|---|---|---|
| GDPR | You process data of ANY person in the EU/UK (regardless of where your company is) | Lawful basis, consent/legitimate interest, DPA, data subject rights, breach notification (72 hrs), DPO (in some cases) | Up to 4% of global annual revenue or €20M |
| CCPA/CPRA | $25M+ revenue OR 100K+ California consumers OR 50%+ revenue from selling data | Right to know/delete/opt-out, privacy notice, data inventory | $2,500 per violation ($7,500 intentional) + private right of action |
| ePrivacy | You use cookies or tracking in the EU | Cookie consent before non-essential cookies, clear disclosure | Up to 4% of global revenue |
| PIPEDA (Canada) | Processing Canadian personal data | Consent, purpose limitation, safeguards | Up to CAD $100K per violation |
| LGPD (Brazil) | Processing Brazilian personal data | Similar to GDPR — consent, rights, breach notification | Up to 2% of Brazilian revenue (capped at R$50M) |
| State laws (US) | Virginia, Colorado, Connecticut, Utah, etc. | Similar to CCPA — varies by state | Varies |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 283 lines · 146 tokens per session scan A 3569e5110831
data-privacy-compliance is a skill published in the GitHub repository LeadMagic/gtm-skills (48 stars, last pushed yesterday), licensed MIT. It adds 146 tokens to every session and 3,253 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
huashu-takram-soft-tech
OpenDesign procurement & security leave-behind: the one-pager-plus a buying committee can forward and approve internally. Built as a decision-grade B2B sales deck for buying committee, security, procurement.
crisis-holding
Draft crisis holding statements, journalist Q&A posture, and what-not-to-say guidance from confirmed incident facts, with a hard legal-counsel gate. Builds each statement through proven crisis-comms frameworks (holding-statement anatomy, SCCT, CAP order, the legitimate non-answer, bridge/flag/block).
startup-launch-playbook
A step-by-step playbook for early-stage startups going from pre-seed to their first 1000 users. Covers MVP validation, initial traction channels, and founder-led growth tactics. By @WeiYipei — follow on X for more startup growth insights.
cialdini-influence
Applies Cialdini's seven principles of ethical persuasion -- Reciprocity, Commitment and Consistency, Social Proof, Authority, Liking, Scarcity, and Unity -- to business contexts including sales, marketing, fundraising, and negotiation. Use when designing conversion funnels, optimizing sales processes, preparing…
competitor-monitoring
Use this skill when you need to know what rival companies are doing — "what are my competitors doing", "competitor update", "competitor news", "competitive landscape", "market intel", "what's new with [company]", "track [company]", "competitor briefing", "who's making moves", "we keep losing deals to [company]" — or…
multichannel-campaign-builder
Use this skill when someone needs a complete outbound sequence written — every touch across LinkedIn and email, not a single cold email. Produces three distinct angles to choose from, then the full sequence with each message ready to send, calibrated to the campaign type and channel mix and self-checked against a…