Privacy and Data Protection Analysis Chain

validated legal chain v1.0.0 cc-by-sa

Block ID: c1f722f8-d84a-4d83-8e90-6272de729ab1

Community-contributed block. PromptDNA makes no guarantee of output quality or fitness for purpose. This block operates in a regulated domain. Nothing generated using this block constitutes professional medical, legal, or financial advice. User assumes all responsibility for use.

This block carries additional risk (risk level: medium) and requires a stronger domain-specific disclaimer when used.

Template

Analyze the data privacy obligations for the data processing described in {processing_activity}, since privacy law reaches by data type and subject location, not by where the business sits. (1) Map the data flow first: what personal data is collected, from whom (and where those individuals are located), for what purpose, where it's stored and processed, and who it's shared with — the map determines which laws apply, and skipping it is the root of most compliance gaps. (2) Determine which privacy regimes govern based on the data subjects' locations and the data types, recognizing that multiple frameworks can apply simultaneously to the same processing and that some (health, financial, children's data) carry heightened rules. (3) Establish the lawful basis for each processing purpose, since processing without a valid basis is unlawful regardless of security measures. (4) Check the individual rights the applicable regime grants (access, deletion, correction, portability, opt-out) and whether the entity can actually honor them within required timeframes. (5) Assess the transfer and vendor dimension: cross-border transfer restrictions and the contractual controls required when sharing data with processors. (6) Identify breach-notification duties and their triggers. State the priority gaps, and note that privacy law is fast-changing, jurisdiction-specific, and requires a qualified privacy attorney to confirm applicability and sufficiency.

Analyze the data privacy obligations for the data processing described in {processing_activity}, since privacy law reaches by data type and subject location, not by where the business sits. (1) Map the data flow first: what personal data is collected, from whom (and where those individuals are located), for what purpose, where it's stored and processed, and who it's shared with — the map determines which laws apply, and skipping it is the root of most compliance gaps. (2) Determine which privacy regimes govern based on the data subjects' locations and the data types, recognizing that multiple frameworks can apply simultaneously to the same processing and that some (health, financial, children's data) carry heightened rules. (3) Establish the lawful basis for each processing purpose, since processing without a valid basis is unlawful regardless of security measures. (4) Check the individual rights the applicable regime grants (access, deletion, correction, portability, opt-out) and whether the entity can actually honor them within required timeframes. (5) Assess the transfer and vendor dimension: cross-border transfer restrictions and the contractual controls required when sharing data with processors. (6) Identify breach-notification duties and their triggers. State the priority gaps, and note that privacy law is fast-changing, jurisdiction-specific, and requires a qualified privacy attorney to confirm applicability and sufficiency.

Variables

Name	Type	Required	Trust level
processing_activity		yes

data-privacydata-protectioncompliancechain-of-thought

Ratings

0.0

Overall (0)

0.0

Accuracy

0.0

Consistency

0.0

Clarity

0.0

Efficiency

Benchmarks

Not yet self-validated against any benchmark. Automated, evaluative only - not a factor in whether this block was published.

Submitted by James P FounderMod via mcp · 2026-07-18