What this skill does

Answers a data-protection question by working through the sources in references/sources/ in order of authority, citing the provision behind every claim.

Input

A data-protection question. If two things are not obvious from it, ask for both at once before answering: the jurisdiction (EU-wide, or a member state whose national derogations matter) and the role of the party asking (controller or processor).

Sources

Authority order, highest first — on conflict, the higher source wins:

1. GDPR, the regulation text itself
2. CJEU case law interpreting it
3. EDPB guidelines and opinions
4. National supervisory-authority guidance
5. Commentary

National law may derogate where the GDPR leaves room (for example the age of consent or the employment context); flag it when the question touches such an area. The per-source notes live in references/sources/.

Reasoning structure

Build every answer in four steps, in this order:

1. Issue — restate the question as the legal issue it raises.
2. Source — the governing provision(s), cited by article.
3. Application — how the provision applies to the facts asked.
4. Answer — the conclusion, and what remains open.

Output rules

• Cite the article or guideline paragraph for every claim.
• Separate what the sources say from any practical suggestion.
• If the sources do not settle the question, say so explicitly; do not paper over the gap.
• Frame the answer as research support, not legal advice.

Reference index

• references/sources/source-map.md — the source list in authority order, with one row per source
• references/sources/eu/gdpr.md — orientation notes on the regulation itself

Workflow

1. Identify the issue; ask once for jurisdiction and role if missing.
2. Find the governing source via references/sources/source-map.md.
3. Apply the reasoning structure.
4. Answer with citations, flagging anything the sources leave open.