{"id":17372,"plugin_id":"plugins_6a762d36049481919d7b0751c31dc01c","kind":"skill","collection_source":null,"comparison_source":null,"observed_at":"2026-09-30T23:14:08.243Z","digest":"e3a7e277c155c6155be13f436ce4ab62af37f93c7abcba4b00e6c891e96ebda7","against":null,"payload":{"description":"Analyse cross-border personal-data transfers, remote access, hosting, support, disclosures, and onward transfers. Use when identifying applicable transfer restrictions, roles, localisation rules, mechanisms, destination risks, supplementary safeguards, notices, approvals, and operational controls.","included_files":[{"relative_path":"agents/openai.yaml","size_in_bytes":344}],"name":"cross-border-transfer-analyst","skill_md_contents":"---\nname: cross-border-transfer-analyst\ndescription: >-\n  Analyse cross-border personal-data transfers, remote access, hosting, support,\n  disclosures, and onward transfers. Use when identifying applicable transfer\n  restrictions, roles, localisation rules, mechanisms, destination risks,\n  supplementary safeguards, notices, approvals, and operational controls.\n---\n\n# Cross-Border Transfer Analyst\n\nAnalyse the concrete transfer, not merely the vendor's headquarters. Include\nremote access, support, backups, telemetry, subprocessors, government requests,\nand onward transfers.\n\n## Intake\n\nObtain exporters, importers, affiliates, controllers and processors, origin and\ndestination countries, data subjects and categories, sensitivity, purpose,\nfrequency, systems, storage and access locations, vendors and subprocessors,\nretention, legal bases, sector rules, existing mechanisms, contracts, technical\ncontrols, and government-access experience.\n\n## Analysis method\n\n1. Draw the end-to-end transfer map and separate collection, disclosure, remote\n   access, transit, storage, onward transfer, repatriation, and deletion.\n2. Identify each law's territorial scope and the parties' legal roles. Distinguish\n   a regulated transfer from processing already directly subject to that law.\n3. Verify whether localisation, approved-country, adequacy, government approval,\n   registration, sector, secrecy, employment, health, financial, or public-record\n   restrictions apply.\n4. Select and verify an available mechanism: adequacy, standard clauses, binding\n   corporate rules, certification, code, consent or another narrow derogation,\n   statutory permission, or local contract. Do not combine incompatible tools.\n5. Complete required annexes with specific parties, data, purposes, frequency,\n   retention, security, onward transfers, authority, governing law, and modules.\n6. Assess destination law and practice, government-access powers, remedies,\n   transparency, importer experience, data sensitivity, access likelihood, and\n   whether the mechanism can operate in practice.\n7. Identify supplementary technical, contractual, and organisational measures,\n   including strong encryption, key control, pseudonymisation, minimisation,\n   split processing, access limits, challenge and notice duties, and audit evidence.\n8. Test onward transfers, subprocessor change, merger, remote support, disaster\n   recovery, law-enforcement requests, and termination.\n9. Align records, notices, DPA, SCC or equivalent, DPIA, security, retention,\n   procurement, and data-subject response processes.\n10. Set approval, implementation, reassessment, suspension, and escalation triggers.\n\n## Output\n\nProvide the transfer map, law and role matrix, mechanism analysis, transfer-risk\nassessment, supplementary-measures plan, contract and notice changes, approval\nrecord, and reassessment calendar.\n\n## Guardrails\n\nDo not treat a contract as sufficient without operational safeguards, use consent\nas a routine substitute where invalid, or assume cloud location equals all access\nlocations. Verify current adequacy, clause versions, localisation, regulator\nguidance, and destination law with qualified counsel.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}