Breach Sentinel — Deployment Guide

📄 View the interactive skill page →

See CHANGELOG.md for version history.

Overview

GDPR Breach Response Sentinel — an advanced incident response skill for Claude that provides:

• Breach qualification triage — "is this even a personal data breach?" gate before the workflow
• ENISA severity assessment with borderline score analysis, bridged to the Art. 33/34 statutory legal tests
• EDPB-template-aligned breach evidence file mirroring the EDPB Template [2026] for breach notification (public consultation window closed 5 Aug 2026; final adoption status not yet re-verified — check the EDPB site)
• EDPB case matching against 18 documented breach scenarios (as analogies, with limits stated)
• Dedicated Art. 34 decision module — high-risk test, all three Art. 34(3) exceptions, communication strategy
• Strategic case advisory — senior counsel-level analysis and recommendations
• Dynamic web research for enforcement precedents and SA-specific guidance, with source discipline
• Flexible mitigation playbooks tailored to the specific incident
• SA contact directory with jurisdiction-specific portal lookup
• AI Act Art. 73 intersection for breaches involving high-risk AI systems
• Sectoral parallel-regime screen (NIS2, DORA, eIDAS, ePrivacy, insurance, works council)
• Audit-ready .docx document generation (evidence file, Art. 33, Art. 34, compliance logs, follow-up/withdrawal, etc.)
• Post-notification case tracking
• Processor track done right — notify controller without undue delay (Art. 33(2)), contractual DPA windows, handoff package; no phantom 72h processor deadline

File Structure

breach-sentinel/
├── SKILL.md                              # Main skill instructions (deploy this)
├── conformance.json                      # Portfolio standard conformance declaration (tier: structural)
├── sources.lock.json                     # Reference-file provenance/freshness manifest
├── evals/
│   └── evals.json                        # 13 test cases, 132 assertions
├── validator/                            # Deterministic structural validator (module breach_validator)
│   ├── validate.py                       # CLI: validate a sidecar, optionally --emit-core-artefact
│   └── fixtures/                         # must_pass / must_fail sidecar fixtures
├── tests/                                # Cross-cutting validator tests (schema self-validity, CLI)
└── references/
    ├── breach-sentinel-sidecar-schema.json  # Native sidecar JSON Schema (machine-readable output)
    ├── enisa-methodology.md              # ENISA scoring tables, legal bridge, worked examples
    ├── edpb-template-evidence-file.md    # EDPB Template [2026] field map + evidence file builder
    ├── art34-communication.md            # Art. 34 decision framework incl. all 34(3) exceptions
    ├── parallel-regimes.md               # AI Act Art. 73 depth + NIS2/DORA/eIDAS/etc. screen
    ├── edpb-cases.md                     # 18 EDPB breach case scenarios + analogy rules
    ├── templates.md                      # 17 document templates (Art. 33/34, handoff, follow-up …)
    ├── strategic-advisory.md             # Advisory framework, principles, tone examples
    ├── mitigation-playbook.md            # Design principles, output format, action categories
    ├── post-notification-tracking.md     # Tracking dashboard template
    └── web-research.md                   # Search query templates, source discipline, DE routing

Deployment

Claude.ai (User Skills)

1. Go to Settings → Profile → Custom Skills (or equivalent)
2. Upload the entire breach-sentinel/ folder structure
3. The skill will auto-trigger when you mention data breaches, Art. 33/34, "Datenpanne", or related topics

Claude Code / Custom MCP Setup

1. Copy the breach-sentinel/ folder to your skills directory: bash cp -r breach-sentinel/ /path/to/your/skills/user/breach-sentinel/
2. Ensure the skill is registered in your configuration

Usage

Quick Start

Just tell Claude about a breach:

"We just discovered that an external attacker exfiltrated our customer database. About 2,000 records with names, emails, and payment data. We're based in Munich. This happened yesterday at 3pm."

The skill will activate and walk you through the assessment.

Trigger Phrases

• "We had a data breach" / "Datenpanne" / "Datenschutzverletzung"
• "Do we need to notify the SA?" / "72 hours" / "Art. 33"
• "Help me assess this breach" / "ENISA assessment"
• "Generate breach notification documents"

Modes

Capabilities Summary

Regulatory Basis

License & Disclaimer

This skill provides guidance based on publicly available GDPR regulatory materials. It does not constitute legal advice. All notification decisions should involve qualified legal counsel and your organization's DPO.

A passing run of the bundled structural validator (validator/validate.py) means a breach-sidecar file is internally consistent and complete against its own schema and rule set — it is not a check that the underlying ENISA severity score or Art. 33/34 notification conclusion is legally correct. That judgment still requires your organization's DPO or qualified legal counsel.

*Created by Oliver Schmidt-Prietz — OneZero Legal