What it does
Uses WordPress's built-in personal data export and erase tools to locate a requester's data across users, comments, orders, and form submissions, confirms what was found in each location, and drafts a response letter confirming what data exists and what action was taken, aimed at meeting the request's statutory deadline.
Install
This skill isn't packaged in an installable registry. It's a plain SKILL.md file you can copy directly. Copy it from the SKILL.md tab and save it at the path for your assistant:
Use it in your AI assistant
Claude Code
.claude/skills/gdpr-data-request-responder/ (or ~/.claude/skills/gdpr-data-request-responder/ for all projects)
GitHub Copilot (VS Code)
.github/skills/gdpr-data-request-responder/
OpenAI Codex
.codex/skills/gdpr-data-request-responder/
Cursor
.cursor/skills/gdpr-data-request-responder/ (or ~/.cursor/skills/gdpr-data-request-responder/ globally)
Compatibility
Any WordPress site; uses the core Privacy > Export/Erase Personal Data tools, admin access required.
The complete SKILL.md for this skill:
---
name: gdpr-data-request-responder
description: Use when a visitor or customer submits a data access, export, or deletion request and the site owner needs to locate the data and draft a response.
---
# GDPR Data Request Responder
## When to use
Someone has requested to see, export, or delete the personal data a site holds about them, and the site owner needs both the data actually located and a compliant, clear response drafted within the request deadline.
## Procedure
1. Confirm the requester's identity and the scope of the request (access, export, or erasure) before searching for any data.
2. Use the core Privacy tools (or the relevant plugin's data export/erase feature, e.g. an ecommerce plugin's customer data tools) to search users, comments, orders, and form submissions tied to the requester's email or account.
3. Compile a plain list of what was found: which systems held data, what type of data, and how long it's been retained.
4. For an access/export request, package the confirmed data into the response; for an erasure request, note what can be deleted immediately versus what must be retained for a legal reason (e.g. financial records) and explain why.
5. Draft the response letter in plain language, confirming what was done and by when, and note the applicable deadline that was met.
6. Log the request and its resolution for the site's own compliance records.
## Guardrails
- Never include another person's personal data in the response by mistake, double check that all located records genuinely belong to the requester before sending anything.
- Do not perform an actual erasure of records without the site owner's explicit approval, especially where legal retention requirements might apply, flag those cases instead of deleting.