FreePublished on GitHub

nist-pf-control

Implement the NIST Privacy Framework CONTROL function covering CT.DM data management, CT.DP data processing policies and procedures, and CT.PO disassociated processing. Provides technical control architectures, data management workflows, and de-identification implementation guidance.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

Run score Not tested

See how to install

Files included (5)

SKILL.md9.9 KB
assets/template.md1.3 KB
references/standards.md1.5 KB
references/workflows.md1.6 KB
scripts/process.py8.1 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

NIST Privacy Framework — CONTROL Function

Overview

The CONTROL function develops and implements appropriate activities to enable organizations and individuals to manage data with sufficient granularity to manage privacy risks. It addresses data management, data processing governance, and disassociated processing techniques.

CONTROL Function Subcategories

CT.DM — Data Management

Policies and procedures for managing data throughout its lifecycle.

Subcategory	Description	Implementation Guidance
CT.DM-P1	Data elements can be accessed for review	Implement data subject access portals. Provide export in machine-readable formats (JSON, CSV). Response within regulatory timelines.
CT.DM-P2	Data elements can be accessed for transmission or disclosure	Support data portability requests. Implement secure transfer mechanisms. Maintain disclosure logs.
CT.DM-P3	Data elements can be accessed for alteration	Enable data correction workflows. Propagate corrections across all systems holding the data.
CT.DM-P4	Data elements can be accessed for deletion	Implement cascading deletion across primary and backup systems. Maintain deletion verification logs. Address data in analytics pipelines.
CT.DM-P5	Data processing activities are configured to meet the organization's data processing principles	Default to most privacy-protective settings. Implement purpose limitation at the system level.
CT.DM-P6	Retention schedules are established and in place	Define retention periods per data category. Implement automated purging. Document legal hold exceptions.
CT.DM-P7	Data are processed in accordance with established retention schedules	Automated enforcement of retention policies. Regular audits of data stores. Reporting on retention compliance.
CT.DM-P8	Integrity of data elements is maintained	Implement checksums and validation rules. Detect and resolve data quality issues. Track data lineage.
CT.DM-P9	Audit/log records are determined, documented, implemented, and reviewed	Privacy-specific audit logging for all data access and modifications. Log retention per regulatory requirements.
CT.DM-P10	Mechanisms for data subjects to authorize processing exist	Consent collection and management infrastructure. Granular consent options. Consent withdrawal capability.

CT.DP — Data Processing Policies and Procedures

Governance controls for data processing activities.

Subcategory	Description	Implementation Guidance
CT.DP-P1	Policies, processes, and procedures for authorizing data processing are maintained and enforced	Document lawful basis for each processing activity. Implement access controls aligned with authorized purposes.
CT.DP-P2	Data processing environment is identified, managed, and monitored	Maintain environment inventory (production, staging, development). Monitor for unauthorized processing. Separate test data from production data.
CT.DP-P3	Data processing procedures are maintained and monitored to meet established terms	Standard operating procedures for each processing type. Automated compliance checking. Exception management workflow.
CT.DP-P4	System or device configurations are set to authorized specifications	Secure configuration baselines for systems processing personal data. Configuration drift detection. Change management for privacy-relevant settings.
CT.DP-P5	Data processing activities are monitored and logged	Real-time monitoring of data processing operations. Anomaly detection for unusual processing patterns. Alerting for policy violations.

CT.PO — Disassociated Processing

Techniques to process data while minimizing identifiability.

Subcategory	Description	Implementation Guidance
CT.PO-P1	De-identification is applied to data elements to limit observability or linkability	Apply pseudonymization, anonymization, or generalization based on use case. Document de-identification methodology.
CT.PO-P2	Technical measures for disassociated processing are implemented	Deploy differential privacy, secure multi-party computation, or homomorphic encryption as appropriate. Select technique based on data utility requirements.

Data Management Architecture

Lifecycle Control Points

Collection --> Storage --> Processing --> Sharing --> Retention --> Deletion
    |            |           |             |            |            |
    v            v           v             v            v            v
 Consent     Encryption   Purpose      Access       Schedule    Cascading
 Capture     at Rest      Limitation   Controls     Enforcement  Purge
    |            |           |             |            |            |
    v            v           v             v            v            v
 Audit Log   Access Log   Process Log  Transfer Log Retention Log Deletion Log

Data Element Access Control Matrix

Operation	Data Subject	Data Steward	Processor	Analyst	Admin
View own data	Yes	Yes	No	No	Yes
Export own data	Yes	Yes	No	No	Yes
Correct own data	Request	Yes	No	No	Yes
Delete own data	Request	Yes	No	No	Yes
View aggregate	No	Yes	Yes	Yes	Yes
Process data	No	No	Yes	No	Yes
Analyze data	No	No	No	Yes	Yes
Configure system	No	No	No	No	Yes

Disassociated Processing Techniques

Technique Selection Guide

Technique	Identifiability Reduction	Data Utility	Computational Cost	Reversible
Pseudonymization	Medium	High	Low	Yes (with key)
k-Anonymity	Medium-High	Medium	Medium	No
l-Diversity	High	Medium	Medium	No
t-Closeness	High	Medium-Low	High	No
Differential Privacy	Very High	Medium	Medium	No
Data Masking	Low-Medium	Medium	Low	Depends
Generalization	Medium	Medium	Low	No
Suppression	High	Low	Low	No
Synthetic Data	Very High	Variable	High	No

De-identification Decision Framework

Is the data being shared externally?
├── Yes → Is re-identification risk acceptable?
│   ├── No → Apply formal anonymization (differential privacy, k-anonymity with k>=5)
│   └── Yes → Apply pseudonymization with contractual controls
└── No → Is the data used for analytics?
    ├── Yes → Apply aggregation or differential privacy
    └── No → Apply pseudonymization with access controls

Retention Schedule Template

Data Category	Retention Period	Legal Basis	Deletion Method	Verification
Customer transaction records	7 years from transaction	Tax/accounting regulations	Secure overwrite	Automated audit
Marketing consent records	Duration of consent + 3 years	Legitimate interest (proof)	Logical deletion	Annual review
Employee personnel files	Employment + 7 years	Employment law	Secure destruction	HR verification
Website analytics	26 months	Consent	Automated purge	Monthly check
Support tickets	3 years from resolution	Contract performance	Secure overwrite	Quarterly audit
CCTV footage	30 days	Legitimate interest	Automated overwrite	Weekly check
Backup tapes	90 days rolling	Business continuity	Tape degaussing	Quarterly audit

Audit Logging Requirements

Privacy-Specific Events to Log

Event Category	Specific Events	Required Fields
Data Access	View, export, download	User ID, timestamp, data subject ID, data elements accessed, purpose
Data Modification	Create, update, correct	User ID, timestamp, data subject ID, before/after values, purpose
Data Deletion	Delete, purge, anonymize	User ID, timestamp, data subject ID, deletion scope, verification
Consent Changes	Grant, withdraw, modify	Data subject ID, timestamp, consent scope, collection channel
Data Transfer	Internal transfer, external disclosure	User ID, timestamp, recipient, data elements, legal basis
Configuration	Access control changes, retention policy changes	Admin ID, timestamp, before/after settings, approval reference

Control Mapping

NIST PF CONTROL	ISO 27701	GDPR Article	NIST 800-53
CT.DM-P1	A.7.3.3	Art. 15	PM-25
CT.DM-P2	A.7.3.7	Art. 20	PM-25
CT.DM-P3	A.7.3.4	Art. 16	PM-25
CT.DM-P4	A.7.3.5	Art. 17	PM-25
CT.DM-P6	A.7.4.7	Art. 5(1)(e)	SI-12
CT.DM-P9	A.7.2.8	Art. 30	AU-2
CT.DM-P10	A.7.2.3	Art. 6, 7	IP-1
CT.DP-P1	A.7.2.2	Art. 6(1)	PT-3
CT.DP-P5	A.7.2.8	Art. 30	AU-6
CT.PO-P1	A.7.4.5	Art. 25(1)	PM-24
CT.PO-P2	A.7.4.5	Art. 25(1)	PM-24

References

NIST Privacy Framework Version 1.0 (January 16, 2020)
NIST SP 800-188 — De-Identifying Government Datasets
NIST IR 8053 — De-Identification of Personal Information
ISO/IEC 20889:2018 — Privacy Enhancing Data De-identification Techniques

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/mukul975/Privacy-Data-Protection-Skills --skill nist-pf-control

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/nist-pf-control

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/nist-pf-control/ for Claude Code, or ~/.agents/skills/nist-pf-control/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: mukul975/Privacy-Data-Protection-Skills
Stars: 317
Forks: 62
Category: Data & AI
License: Apache-2.0
Original language: English
Last updated: Mar 17, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.