Skip to content

Commit 6af6487

Browse files
maxwellokumumaxwellokumu
authored
Merge pull request #3 from maxwellokumu/Feature-Phase4-NetworkSecurity_DataPrivacy
feat: Phase 4 — Network Security and Data Privacy skills
2 parents db352d5 + 5108edd commit 6af6487

31 files changed

Lines changed: 4479 additions & 0 deletions

File tree

‎data-privacy/consent-checker/README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# consent-checker
2+
3+
Analyses a plain-text privacy policy against built-in requirement libraries for GDPR (16 requirements), CCPA (11 requirements), or PDPA Thailand (10 requirements). Produces a weighted compliance score, requirements-met table, and a detailed gap analysis with risk ratings and remediation recommendations.
4+
5+
## Requirements
6+
7+
```
8+
python-dotenv
9+
```
10+
11+
## Usage
12+
13+
### GDPR check (default)
14+
```bash
15+
python main.py --policy sample_input/privacy_policy.txt
16+
```
17+
18+
### CCPA check
19+
```bash
20+
python main.py --policy sample_input/privacy_policy.txt --framework ccpa
21+
```
22+
23+
### PDPA check
24+
```bash
25+
python main.py --policy sample_input/privacy_policy.txt --framework pdpa
26+
```
27+
28+
## Scoring
29+
30+
Requirements are weighted 1–5 (5 = most critical). The compliance score is the weighted percentage of met requirements:
31+
32+
| Rating | Score |
33+
|--------|-------|
34+
| ✅ Compliant | ≥ 85% |
35+
| ⚠️ Partial | 60–84% |
36+
| ❌ Non-Compliant | < 60% |
37+
38+
## Sample Output
39+
40+
```markdown
41+
# Privacy Policy Compliance Report
42+
43+
**Framework:** GDPR
44+
**Policy Word Count:** 612
45+
46+
## Compliance Score
47+
48+
| Metric | Value |
49+
|--------|-------|
50+
| Requirements Checked | 16 |
51+
| Requirements Met | 11 |
52+
| Requirements Missing | 5 |
53+
| Weighted Score | 42/57 points (73.7%) |
54+
| Overall Rating | ⚠️ **Partial** |
55+
56+
## Requirements Met
57+
58+
| ID | Requirement | Matched On | Status |
59+
|----|-------------|------------|--------|
60+
| GDPR-01 | Identity of the data controller | `data controller` | ✅ Met |
61+
...
62+
63+
## Missing Requirements
64+
65+
| ID | Requirement | Weight | Risk | Recommendation |
66+
|----|-------------|--------|------|----------------|
67+
| GDPR-14 | Automated decision-making disclosure | 3/5 | Medium | ... |
68+
```

‎data-privacy/consent-checker/main.py‎

Lines changed: 591 additions & 0 deletions
Large diffs are not rendered by default.

‎data-privacy/consent-checker/sample_input/privacy_policy.txt‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
PRIVACY NOTICE
2+
Acme Solutions Ltd
3+
Last updated: January 2024
4+
5+
1. WHO WE ARE
6+
7+
Acme Solutions Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are a software company registered in England and Wales, company number 12345678, with our registered office at 100 Tech Street, London, EC1A 1BB.
8+
9+
If you have any questions about this privacy notice or our data protection practices, please contact our Privacy Team at privacy@acmesolutions.com.
10+
11+
2. WHAT PERSONAL DATA WE COLLECT
12+
13+
We collect and process the following categories of personal data:
14+
15+
- Contact information: name, email address, telephone number, postal address
16+
- Account information: username, password (hashed), account preferences
17+
- Usage data: pages visited, features used, time and date of access, IP address
18+
- Payment information: billing address, last four digits of card (full card numbers are processed by our payment provider and not stored by us)
19+
- Communications: emails and messages you send to us
20+
21+
3. WHY WE COLLECT YOUR DATA AND OUR LEGAL BASIS
22+
23+
We process your personal data for the following purposes and rely on the following legal bases:
24+
25+
- To provide our software services under the contract between us (legal basis: contract)
26+
- To send you service updates and account notifications (legal basis: contract)
27+
- To send you marketing communications where you have signed up to receive them (legal basis: consent)
28+
- To comply with legal and regulatory obligations such as tax reporting (legal basis: legal obligation)
29+
- To improve our products and detect fraud (legal basis: legitimate interests)
30+
31+
4. WHO WE SHARE YOUR DATA WITH
32+
33+
We may share your personal data with the following third parties and service providers:
34+
35+
- Cloud infrastructure providers (Amazon Web Services) who host our platform
36+
- Payment processors who handle billing transactions on our behalf
37+
- Analytics providers who help us understand how our platform is used
38+
- Legal and regulatory authorities where required by law
39+
40+
All our third-party processors are bound by data processing agreements and are required to maintain appropriate security standards.
41+
42+
5. HOW LONG WE KEEP YOUR DATA
43+
44+
We retain your personal data only for as long as necessary:
45+
46+
- Account data is retained for the duration of your subscription plus 2 years after closure
47+
- Financial and billing records are retained for 7 years to comply with tax regulations
48+
- Marketing contact data is retained until you withdraw your consent or unsubscribe
49+
- Usage logs are retained for 90 days
50+
51+
6. YOUR RIGHTS
52+
53+
As a data subject, you have the following rights under UK GDPR:
54+
55+
Right to access: You have the right to request a copy of the personal data we hold about you by submitting a subject access request (SAR) to privacy@acmesolutions.com.
56+
57+
Right to rectification: If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to correct it. Please contact us to update your information.
58+
59+
Right to erasure: You have the right to request that we delete your personal data in certain circumstances, for example if you withdraw your consent or if we no longer need the data for the original purpose.
60+
61+
Right to restrict processing: You have the right to request that we limit how we use your data in certain circumstances, for example while we verify the accuracy of your data.
62+
63+
Right to data portability: Where we process your data based on your consent or on a contract, you have the right to receive a copy of your data in a structured, machine-readable format.
64+
65+
Right to object: You have the right to object to processing where we rely on legitimate interests as our legal basis, including the right to opt out of direct marketing communications at any time.
66+
67+
Right to withdraw consent: Where we process your data based on your consent, you have the right to withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at privacy@acmesolutions.com. Withdrawal of consent does not affect the lawfulness of any processing carried out before withdrawal.
68+
69+
7. INTERNATIONAL DATA TRANSFERS
70+
71+
Some of our service providers are located outside the UK and European Economic Area. When we transfer your personal data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses (SCCs) approved by the relevant supervisory authority, or we transfer to countries with an adequacy decision.
72+
73+
8. DATA SECURITY
74+
75+
We take the security of your data seriously. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encryption at rest and in transit, access controls, and regular security assessments.
76+
77+
9. COMPLAINTS
78+
79+
If you have a concern about how we handle your personal data, we encourage you to contact us first at privacy@acmesolutions.com so we can address your concern. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at www.ico.org.uk.
80+
81+
10. CHANGES TO THIS NOTICE
82+
83+
We may update this privacy notice from time to time. We will notify you of significant changes by email or by posting a notice on our website.
84+
85+
For any questions about this privacy notice, please contact: privacy@acmesolutions.com

‎data-privacy/consent-checker/skill.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: "consent-checker"
2+
version: "1.0.0"
3+
description: "Analyses a privacy policy text file against GDPR, CCPA, or PDPA requirements and produces a weighted compliance score with gap analysis."
4+
author: "IT Audit Team"
5+
license: "MIT"
6+
triggers:
7+
- keywords: ["privacy policy", "consent", "GDPR compliance", "CCPA", "PDPA", "data subject rights", "privacy notice"]
8+
- patterns: ["check.*privacy.*policy", "analyse.*consent", "review.*privacy.*notice"]
9+
parameters:
10+
- name: policy
11+
type: string
12+
required: true
13+
description: "Path to privacy policy .txt file"
14+
- name: framework
15+
type: string
16+
required: false
17+
description: "Compliance framework: gdpr (default), ccpa, or pdpa"
18+
execution:
19+
runtime: "python"
20+
command: "python main.py"
21+
args: ["--policy", "{{policy}}", "--framework", "{{framework}}"]

‎data-privacy/data-inventory-mapper/README.md‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
# data-inventory-mapper
2+
3+
Reads a structured data inventory CSV and produces a Mermaid data flow diagram plus a comprehensive markdown summary. Highlights Special Category data (GDPR Article 9), missing legal bases, and retention coverage.
4+
5+
## Requirements
6+
7+
```
8+
python-dotenv
9+
```
10+
11+
## Usage
12+
13+
### Both diagram and summary (default)
14+
```bash
15+
python main.py --inventory sample_input/data_inventory.csv
16+
```
17+
18+
### Mermaid diagram only
19+
```bash
20+
python main.py --inventory sample_input/data_inventory.csv --output mermaid
21+
```
22+
23+
### Markdown summary only
24+
```bash
25+
python main.py --inventory sample_input/data_inventory.csv --output markdown
26+
```
27+
28+
## CSV Format
29+
30+
Required columns: `system,data_type,classification,location,transfers_to,legal_basis,retention_period`
31+
32+
```csv
33+
system,data_type,classification,location,transfers_to,legal_basis,retention_period
34+
CRM,contact_details,Confidential,On-premise,Email Platform,legitimate_interests,3 years
35+
HR System,health,Special_Category,Cloud (Azure),Payroll System,legal_obligation,7 years
36+
```
37+
38+
## Classification Levels
39+
40+
`Public` | `Internal` | `Confidential` | `Restricted` | `Special_Category`
41+
42+
## Special Category Detection
43+
44+
Automatically flags records containing: health, medical, biometric, genetic, racial/ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records, financial data, or children's data.
45+
46+
## Sample Output
47+
48+
```markdown
49+
## Data Flow Diagram
50+
51+
```mermaid
52+
flowchart LR
53+
classDef special fill:#ff4444,color:#fff,stroke:#cc0000
54+
CRM["CRM"]
55+
HR_System["HR System"]
56+
HR_System -->|"health"| Payroll_System
57+
class HR_System special
58+
```
59+
60+
## Data Inventory by Classification
61+
62+
### Special_Category (2 records)
63+
64+
| System | Data Type | Location | Legal Basis | Retention |
65+
|--------|-----------|----------|-------------|-----------|
66+
| **HR System** 🔴 | health | Cloud (Azure) | legal_obligation | 7 years |
67+
```

0 commit comments

Comments
 (0)