dach-compliance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dach-compliance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
DACH markets — Germany, Austria, Switzerland — have a stricter and more enforced compliance regime than most jurisdictions. The good news: a small set of pages plus a cookie banner satisfies the common case. The bad news: missing any one of them is a real risk, particularly in Germany where commercial cease-and-desist (Abmahnung) is a small industry.
This skill is about the technical implementation of these requirements. It is not legal advice. For non-trivial cases (especially regulated industries, B2B SaaS at scale, or anything cross-border), retain a DACH-qualified lawyer.
| Page | Slug convention | What it is |
|---|---|---|
| Impressum | /impressum | Legal identification of the operator. Required by §5 TMG (DE), §25 MedienG (AT), and §3 lit. s UWG (CH). |
| Datenschutzerklärung | /datenschutz or /datenschutzerklaerung | Privacy policy compliant with GDPR + national law (TTDSG / TKG 2021 / FADP). |
| AGB | /agb | General Terms and Conditions — required for online sale of goods/services in B2C, strongly recommended in B2B. |
| Cookie banner | site-wide overlay | Consent UI for non-essential cookies/tracking. |
The Impressum and Datenschutzerklärung must be reachable from every page with no more than two clicks and the link text must be unambiguous. Footer links named exactly "Impressum" and "Datenschutz" are the safe pattern.
The legally required content varies slightly by jurisdiction. A safe combined Impressum for a site targeting all three:
Anbieter / Verantwortlich
[Vor- und Nachname / Firmenname mit Rechtsform]
[Straße Hausnummer]
[PLZ Ort]
[Land]
Kontakt
Telefon: +43 ...
E-Mail: [email protected]
[Optional: Kontaktformular-Link]
Vertretungsberechtigte
[Bei juristischen Personen: Geschäftsführer / Vorstand mit Vor- und Nachname]
Handelsregister / Firmenbuch
[Registergericht / Firmenbuchgericht]
[Registernummer / Firmenbuchnummer]
Umsatzsteuer-Identifikationsnummer
[UID / USt-IdNr.]
Aufsichtsbehörde
[Sofern Gewerbe mit Behördenaufsicht]
Berufsbezeichnung und Kammer
[Bei reglementierten Berufen — Ärzte, Anwälte, Steuerberater etc.]
Online-Streitbeilegung (EU)
Die EU-Kommission stellt eine Plattform zur Online-Streitbeilegung bereit:
https://ec.europa.eu/consumers/odr/
Verantwortlich für den Inhalt nach § 18 Abs. 2 MStV (DE) bzw. § 25 MedienG (AT)
[Vor- und Nachname, Anschrift]Implementation rules:
robots.txt block.A static template copied from a generator is a finding, not compliance. The privacy policy must reflect every processing operation actually happening on the site.
Per processing activity, document:
Common DACH-site processing to enumerate:
youtube-nocookie.com)Sync the privacy policy with the data inventory from gdpr-technical-controls — they should never disagree.
Under TTDSG §25 (DE) / §165 TKG 2021 (AT) / DSG (CH, more permissive), you may only store or read information on the user's device with prior, informed, opt-in consent — except for strictly necessary cookies.
The banner must:
Acceptable banner stacks:
Wire it to actual script-loading: scripts that depend on a category only run after the user opts in. A consent record without enforced gating is theater.
Required for B2C e-commerce; strongly recommended for B2B and for SaaS. AGB must:
/agb)Templates are a starting point, not the finished product. Have a DACH e-commerce lawyer review the AGB before launch if you sell B2C.
Every third party that processes personal data on your behalf needs an Auftragsverarbeitungsvertrag (AVV) under Art. 28 GDPR (in EN: Data Processing Agreement / DPA).
Engineering side:
Art. 32 GDPR requires you to implement appropriate TOMs. For an audit, you need a written document. For your security posture, you need the underlying controls to actually exist. The two should match.
Typical TOMs sections (with the skills in this repo that implement them):
| TOM area | Implementation |
|---|---|
| Zutrittskontrolle (physical access) | Office locks, server location (cloud DC ISO 27001 etc.) |
| Zugangskontrolle (system access) | Strong auth, MFA — see auth-hardening |
| Zugriffskontrolle (data access) | Role separation, RLS — see postgres-hardening |
| Weitergabekontrolle (transit) | TLS, encrypted backups — see site-server-audit, postgres-hardening |
| Eingabekontrolle (audit) | Audit logging — see log-strategy |
| Auftragskontrolle (processor) | DPAs/AVVs, processor vetting |
| Verfügbarkeitskontrolle (availability) | Backups, restore tests, monitoring |
| Trennungsgebot (purpose separation) | Tenant isolation, separate environments |
Write this document early — once your stack is set, generate the TOMs from what you've actually built.
Switzerland's revised FADP (2023) is close to GDPR but not identical:
For sites targeting EU + CH together, GDPR-compliant is generally CH-compliant; document the small deltas if you operate from Switzerland.
When auditing a DACH site:
fonts.googleapis.com (instead of self-hosted) — Munich and Vienna courts have ruled against thisyoutube-nocookie.com and gate behind consent)/agb despite selling to consumersBefore launching or relaunching a DACH-facing site:
/impressum exists, complete, reachable from every page/datenschutz matches actual processing, lists every processor/agb exists for any B2C selling; Widerrufsbelehrung included~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.