--- name: continuous-compliance-66de65dccdbf description: >- Guides continuous privacy compliance monitoring implementation including automated control testing, evidence collection automation, real-time compliance dashboards, alert-based remediation workflows, regulatory change integration, and deviation management. Covers GRC platform configuration, control framework mapping, and compliance-as-code approaches. Keywords: continuous compliance, automated monitoring, evidence collection, dashboard, regulatory change, compliance-as-code. license: Apache-2.0 metadata: author: mukul975 version: "1.0" domain: privacy subdomain: privacy-audit-certification tags: "continuous-compliance, automated-monitoring, evidence-collection, dashboard, regulatory-change" --- # Continuous Privacy Compliance Monitoring ## Overview Continuous compliance monitoring replaces the traditional point-in-time audit model with an ongoing, automated approach to verifying that privacy controls are operating effectively. Rather than discovering compliance gaps during annual audits, continuous monitoring provides real-time visibility into control performance, enabling immediate remediation before gaps become regulatory violations or data breaches. The shift from periodic to continuous monitoring is driven by several factors: the increasing frequency of regulatory changes (GDPR enforcement guidance, new US state privacy laws, sector-specific regulations), the growing complexity of data ecosystems (cloud, SaaS, APIs, third-party integrations), and supervisory authority expectations for demonstrable accountability under Art. 5(2) GDPR. Sentinel Compliance Group implemented continuous privacy compliance monitoring in 2023, reducing time-to-detect compliance deviations from an average of 94 days (quarterly audit cycle) to 2.3 days (automated monitoring with alert-based triage). ## Architecture ### Three-Layer Monitoring Architecture ``` ┌─────────────────────────────────────────────────────┐ │ LAYER 3: REPORTING │ │ Executive Dashboards │ Regulatory Reports │ Alerts │ ├─────────────────────────────────────────────────────┤ │ LAYER 2: ANALYSIS │ │ Control Scoring │ Trend Analysis │ Risk Correlation │ ├─────────────────────────────────────────────────────┤ │ LAYER 1: DATA COLLECTION │ │ Automated Tests │ Evidence Harvest │ External Feeds │ └─────────────────────────────────────────────────────┘ ``` ### Layer 1: Data Collection **Automated Control Tests** execute pre-defined checks against systems, configurations, and data: | Test Category | Data Source | Test Examples | Frequency | |---------------|-------------|---------------|-----------| | Configuration Compliance | Cloud APIs (AWS, Azure, GCP) | Encryption at rest enabled, access logging active, data residency verified | Daily | | Access Control | IAM systems (Okta, Azure AD) | Privileged access reviews current, terminated users deprovisioned, RBAC aligned with data classification | Daily | | Data Lifecycle | Database metadata, storage systems | Retention periods enforced, deletion jobs executing, backup encryption verified | Daily | | Consent Records | CMP platforms (OneTrust, Cookiebot) | Consent records complete, withdrawal honored, opt-out signals processed | Real-time | | DSAR Processing | DSAR management system | Open DSARs within SLA, response quality checks, identity verification completed | Daily | | Vendor Compliance | Vendor management platform | DPAs current, certifications valid, sub-processor lists updated | Weekly | | Training Compliance | LMS (Learning Management System) | Training completion rates, overdue assignments, content currency | Weekly | | Policy Currency | Document management system | Policy review dates, approval status, version control | Weekly | | Breach Readiness | Incident response tools | Response plan current, tabletop exercise conducted, contact lists updated | Monthly | | Transfer Safeguards | Contract management, TIA register | SCCs executed, TIAs current, adequacy decisions monitored | Weekly | **Evidence Harvesting** automatically collects and timestamps compliance artifacts: | Evidence Type | Collection Method | Storage | Retention | |---------------|-------------------|---------|-----------| | System screenshots | Automated screenshot capture via API | Evidence repository with hash verification | 3 years | | Configuration exports | API calls to target systems | Versioned configuration store | 3 years | | Log extracts | SIEM/log aggregator queries | Immutable audit log archive | Per regulatory requirement | | Consent records | CMP database export | Dedicated consent evidence store | Duration of processing + 5 years | | DSAR records | Workflow system export | DSAR archive with access controls | 3 years after request closure | | Training records | LMS completion export | HR evidence repository | Employment duration + 2 years | | Contract documents | Contract management system | Legal document repository | Contract duration + 6 years | **External Feeds** ingest regulatory and threat intelligence: | Feed Type | Source | Purpose | |-----------|--------|---------| | Regulatory changes | OneTrust DataGuidance, IAPP, Official Journals | Detect new laws, guidance, and enforcement actions | | Enforcement actions | Supervisory authority RSS feeds, GDPRhub | Learn from peer enforcement and adjust controls | | Vendor risk intelligence | BitSight, SecurityScorecard | Monitor vendor security posture changes | | Threat intelligence | CISA, ENISA, sector ISACs | Correlate privacy risks with emerging threats | ### Layer 2: Analysis **Control Scoring Engine:** Each control is scored based on automated test results: | Score | Status | Definition | |-------|--------|------------| | 100 | Effective | All automated tests pass; evidence is current and complete | | 75-99 | Mostly Effective | Minor deviations detected; evidence gaps exist but are non-material | | 50-74 | Partially Effective | Material deviations detected; some evidence missing or outdated | | 25-49 | Largely Ineffective | Multiple failures; significant evidence gaps; control is not reliably operating | | 0-24 | Ineffective | Control is not operating; no evidence of implementation | **Aggregation Logic:** - **Control Level**: Average of all test results for that control (weighted by test criticality) - **Domain Level**: Weighted average of all control scores within the domain - **Regulation Level**: Weighted average of all controls mapped to a specific regulation - **Overall Compliance Score**: Weighted average of all domain scores **Trend Analysis:** - 7-day rolling average to smooth transient deviations - 30-day trend to identify systematic degradation - Quarter-over-quarter comparison for management reporting - Year-over-year comparison for board reporting **Risk Correlation:** - Cross-reference control failures with data sensitivity classifications - Correlate compliance deviations with recent system changes - Map control failures to regulatory exposure (which regulations are affected) - Identify compounding risks (multiple control failures in the same data flow) ### Layer 3: Reporting **Real-Time Dashboards:** | Dashboard | Audience | Content | Refresh Rate | |-----------|----------|---------|--------------| | Privacy Operations | Privacy team | Control-level scores, open deviations, DSAR metrics, vendor status | Real-time | | Executive Privacy | CPO, CISO, CLO | Domain-level scores, trend analysis, top risks, regulatory exposure | Daily | | Board Privacy | Board/Audit Committee | Overall compliance score, year-over-year trend, peer benchmarking, material incidents | Quarterly | | Regulatory | DPO, Legal | Regulation-specific scores, gap details, enforcement tracker | Weekly | | Vendor | Procurement, Third-Party Risk | Vendor compliance scores, DPA status, certification expiry | Weekly | ## Automated Control Testing ### Control Testing Framework For each privacy control, define: ```yaml control_id: PCC-DSAR-001 control_name: DSAR Response Timeliness regulation_mapping: - GDPR Art. 12(3) - CCPA Section 1798.130(a)(2) - LGPD Art. 18 domain: Data Subject Rights test_definition: test_type: data_query data_source: dsar_management_system query: | SELECT request_id, received_date, response_date, DATEDIFF(day, received_date, COALESCE(response_date, GETDATE())) as days_elapsed, jurisdiction, status FROM dsar_requests WHERE status IN ('open', 'in_progress', 'completed') AND received_date >= DATEADD(day, -90, GETDATE()) pass_criteria: - field: days_elapsed condition: less_than_or_equal value: 30 filter: "jurisdiction = 'GDPR' AND status != 'completed'" - field: days_elapsed condition: less_than_or_equal value: 45 filter: "jurisdiction = 'CCPA' AND status != 'completed'" - field: days_elapsed condition: less_than_or_equal value: 30 filter: "status = 'completed'" threshold: 0.95 # 95% of completed requests must meet deadline frequency: daily alert_threshold: 0.90 # Alert if pass rate drops below 90% alert_recipients: - privacy-operations@sentinelcompliance.com - dpo@sentinelcompliance.com evidence_collection: - type: query_result description: Full DSAR status report with elapsed days - type: screenshot description: DSAR dashboard showing current queue status ``` ### Common Automated Test Patterns #### Configuration Compliance Test ```yaml control_id: PCC-ENC-001 control_name: Database Encryption at Rest test_type: api_check data_source: aws_rds_api check: api_call: describe_db_instances assertion: StorageEncrypted == true scope: all_instances frequency: daily remediation_automation: enabled: true action: create_jira_ticket priority: high assignee: database-team ``` #### Evidence Currency Test ```yaml control_id: PCC-DPA-001 control_name: DPA Currency test_type: data_query data_source: contract_management_system query: | SELECT vendor_name, dpa_expiry_date, DATEDIFF(day, GETDATE(), dpa_expiry_date) as days_until_expiry FROM vendor_contracts WHERE contract_type = 'DPA' AND status = 'active' pass_criteria: - field: days_until_expiry condition: greater_than value: 0 description: No expired DPAs alert_rules: - condition: days_until_expiry <= 30 severity: warning message: "DPA for {vendor_name} expires in {days_until_expiry} days" - condition: days_until_expiry <= 0 severity: critical message: "DPA for {vendor_name} has expired" frequency: daily ``` #### Training Compliance Test ```yaml control_id: PCC-TRN-001 control_name: Privacy Training Completion test_type: api_check data_source: lms_api check: api_call: get_course_completion course_id: PRIV-001-ANNUAL assertion: completion_rate >= 0.95 scope: all_active_employees frequency: weekly alert_threshold: 0.90 escalation: - level: 1 condition: completion_rate < 0.95 action: notify_manager - level: 2 condition: completion_rate < 0.90 action: notify_cpo - level: 3 condition: completion_rate < 0.80 action: notify_audit_committee ``` ## Alert-Based Remediation ### Alert Severity Classification | Severity | Criteria | Response SLA | Notification | |----------|----------|-------------|--------------| | Critical | Control failure affecting high-sensitivity data OR regulatory deadline at risk OR active data exposure | 4 hours | CPO, CISO, DPO, Privacy Ops lead — immediate notification via PagerDuty/Slack | | High | Control failure affecting personal data OR compliance score below threshold OR vendor DPA expired | 24 hours | Privacy Ops team, control owner — email + Slack notification | | Medium | Control degradation (score decrease >10 points) OR evidence gap detected OR training overdue | 72 hours | Control owner — email notification | | Low | Minor deviation OR informational alert OR upcoming deadline | 1 week | Control owner — daily digest | ### Remediation Workflow ``` Alert Triggered ↓ Auto-Triage (severity classification, deduplication, correlation) ↓ Alert Assigned to Control Owner ↓ Control Owner Acknowledges (within SLA) ↓ Root Cause Analysis ↓ Remediation Plan Documented ↓ Remediation Executed ↓ Automated Re-Test ↓ Pass? → Alert Closed → Evidence Archived ↓ Fail? → Escalate → Revised Remediation Plan ``` ### Auto-Remediation For specific control failures, automated remediation can be configured: | Control Failure | Auto-Remediation Action | Human Approval Required | |----------------|------------------------|------------------------| | Terminated user still has access | Disable account via IAM API | No (immediate) | | Encryption disabled on new resource | Enable encryption via cloud API | No (immediate) | | Expired DPA detected | Generate renewal notification to vendor manager | Yes (notification only) | | Training overdue > 30 days | Send automated reminder to employee and manager | No (notification) | | Consent record missing timestamp | Flag record for manual review | Yes (review required) | | DSAR approaching SLA deadline | Escalate to privacy operations lead | No (escalation only) | ## Regulatory Change Integration ### Regulatory Change Management Process ``` External Regulatory Feed ↓ Change Detection (new law, amendment, guidance, enforcement action) ↓ Relevance Assessment (automated keyword matching + manual review) ↓ Impact Analysis (which controls, processes, and systems are affected) ↓ Gap Assessment (current compliance vs. new requirement) ↓ Remediation Planning (control updates, policy changes, system modifications) ↓ Implementation and Testing ↓ Control Framework Updated ↓ Monitoring Rules Adjusted ``` ### Regulatory Change Categories | Category | Response Timeline | Example | |----------|------------------|---------| | New regulation enacted | Assessment within 30 days; implementation by effective date | New US state privacy law with 12-month implementation window | | Existing regulation amended | Assessment within 14 days; implementation per amendment effective date | GDPR delegated act modifying adequacy decision | | Supervisory authority guidance | Assessment within 30 days; implementation within 90 days | EDPB guidelines on consent for cookie walls | | Enforcement action (peer) | Lessons-learned review within 14 days; control gap check within 30 days | DPA fine for inadequate DSAR response process | | Court decision | Legal review within 14 days; impact assessment within 30 days | CJEU judgment invalidating transfer mechanism | ### Control Framework Versioning When regulatory changes require control updates: 1. Document the regulatory change and its impact on existing controls 2. Draft updated control definitions and test criteria 3. Review and approve changes through the privacy governance committee 4. Update automated test configurations 5. Re-baseline compliance scores (distinguish between score changes due to new requirements vs. degradation) 6. Communicate changes to control owners and affected stakeholders ## Compliance-as-Code ### Infrastructure Privacy Compliance Embed privacy compliance checks into infrastructure-as-code (IaC) pipelines: ```yaml # Example: Terraform compliance policy for data residency policy "data_residency_eu" { description = "Ensure EU personal data is stored in EU regions only" enforcement_level = "mandatory" rule "storage_location" { condition = resource.aws_s3_bucket.region in ["eu-west-1", "eu-central-1", "eu-north-1"] message = "S3 buckets containing EU personal data must be in EU regions" } rule "encryption_required" { condition = resource.aws_s3_bucket.server_side_encryption_configuration != null message = "S3 buckets containing personal data must have encryption enabled" } rule "versioning_enabled" { condition = resource.aws_s3_bucket.versioning[0].enabled == true message = "S3 buckets containing personal data must have versioning enabled for audit trail" } rule "public_access_blocked" { condition = resource.aws_s3_bucket_public_access_block.block_public_acls == true message = "S3 buckets containing personal data must block public access" } } ``` ### Application Privacy Compliance Integrate privacy checks into CI/CD pipelines: | Pipeline Stage | Privacy Check | Blocking? | |---------------|---------------|-----------| | Code Review | PII detection in code comments, logs, and test data | Yes | | Static Analysis | Privacy annotation verification (data classification, retention, purpose) | Yes | | Build | Dependency check for privacy-impacting libraries | Warning | | Integration Test | Consent enforcement verification, DSAR endpoint testing | Yes | | Pre-Deploy | Data residency verification, encryption verification | Yes | | Post-Deploy | Privacy header verification, cookie consent verification | Monitoring | ## Dashboard Design ### Executive Dashboard Components **Overall Compliance Score (large numeric display):** - Current score: 94.2% - 30-day trend: +1.3% - Target: 95% **Compliance by Regulation (horizontal bar chart):** ``` GDPR: ████████████████████░ 96% CCPA/CPRA: ███████████████████░░ 93% LGPD: ██████████████████░░░ 91% PIPA: ████████████████████░ 97% UK GDPR: ███████████████████░░ 94% ``` **Open Deviations by Severity (donut chart):** - Critical: 0 - High: 2 - Medium: 8 - Low: 15 **Control Health Heatmap (10x grid, one cell per domain):** - Green (>90%): Privacy Governance, Risk Management, Incident Management, Training - Yellow (75-90%): Data Inventory, Regulatory, DSR, Consent, Third-Party - Red (<75%): None - Grey: Privacy by Design (assessment in progress) **Top 5 Deviations Requiring Attention (table):** | ID | Control | Score | Days Open | Owner | |----|---------|-------|-----------|-------| | DEV-2025-089 | Vendor DPA Renewal (Vendor X) | 0 | 12 | Procurement | | DEV-2025-091 | DSAR Response SLA (LGPD) | 67 | 5 | Privacy Ops | | DEV-2025-088 | Training Completion (Engineering) | 88 | 21 | L&D | | DEV-2025-092 | Cookie Consent Banner (FR site) | 72 | 3 | Marketing | | DEV-2025-087 | Retention Job Failure (Archive DB) | 50 | 8 | Data Engineering | ## Sentinel Compliance Group Implementation - **Platform**: OneTrust GRC for compliance management; custom Python automation layer for evidence harvesting; Grafana for dashboards - **Controls Monitored**: 312 privacy controls across 10 domains, mapped to GDPR, CCPA/CPRA, LGPD, PIPA, and UK GDPR - **Automated Tests**: 478 automated test cases executing daily/weekly per schedule - **Evidence Collection**: 12,400 evidence artifacts automatically collected per quarter - **Alert Volume**: Average 23 alerts per week (2 high, 7 medium, 14 low); average resolution time: 2.3 days - **Overall Compliance Score**: 94.2% (December 2024), up from 87.1% at program launch (January 2024) - **Audit Impact**: External auditors (SOC 2 and ISO 27701) accepted continuous monitoring evidence, reducing audit fieldwork by 30% - **Regulatory Changes Processed**: 47 regulatory changes assessed in 2024; 12 required control updates; average time from change detection to control update: 18 days --- Source attribution: mukul975 Original project: https://github.com/mukul975/Privacy-Data-Protection-Skills/blob/9b2ef9eae161c00a17241d42a388571321b33e9f/plugins/privacy-skills-complete/skills/continuous-compliance/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS Copyright 2025 Mahipal Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: mukul975 Original project: https://github.com/mukul975/Privacy-Data-Protection-Skills/blob/9b2ef9eae161c00a17241d42a388571321b33e9f/plugins/privacy-skills-complete/skills/continuous-compliance/SKILL.md Attribution basis: Source repository record Fields of work: Legal, Data & Analytics, Operations, Product Management Roles: Compliance Officer, Data Analyst, Business Process Analyst, Product Manager, Technical Product Manager Specialties: Specialty not specified Tools: AWS, Azure, GCP, One Trust, Cookiebot Country applicability: Country not specified Classification basis: Source category, role and specialization labels Instruction SHA-256: e8924fd55d046b760e31c48a18503474acaea9935cc3193e2ac233f6adceaab9