Reference · plugin fact sheet

`privacy-legal`

The ground-truth summary behind Module 5. Every line below was read from the plugin's actual files (version 1.0.2, checked 2026-06-29) — paths cite the live repo.

Identity

From .claude-plugin/plugin.json: “Triages processing activities, generates PIAs, reviews DPAs as controller or processor, drafts DSAR responses within statutory timelines, and monitors policy drift against practice.”

The 9 skills, by job

Job	Skills
Set up & tune the profile	`cold-start-interview` (controller/processor + which regs apply), `customize` (one change at a time; refuses sub-minimum DSAR deadlines), `matter-workspace` (multi-client only — off for in-house)
Decide before you ship	`use-case-triage` (4-way verdict: PROCEED / PIA REQUIRED / DPIA MANDATORY / STOP), `pia-generation` (PIA in house format; lawful-basis table; “the policy or the feature has to change”)
Review the paper	`dpa-review` (term-by-term, processor or controller side auto-detected, with the GLBA / HIPAA-BAA / FERPA / COPPA sectoral overlay)
Answer the data subject	`dsar-response` (clock-driven access/deletion/portability → two letters: acknowledgment now + substantive by the deadline)
Keep it current	`policy-monitor` (internal drift across five surfaces — policy, cookie banner, App Store / Data Safety labels, consent flows, sectoral notices), `reg-gap-analysis` (external change — scope-first, delta-not-full-text, owners + dates)

No subagents, empty hooks

Unlike commercial-legal (3 subagents) or litigation-legal (1), privacy-legal ships no subagents and an empty hooks/hooks.json ({ "hooks": {} }). The “monitor” here is a skill you run (policy-monitor), not a scheduled agent — and its weekly cadence would need a scheduled-tasks connector, which this plugin doesn't bundle, so sweeps run on demand.

The 2 bundled connectors — and the one that's missing

From .mcp.json: Slack and Google Drive only. No research / statute / case-law connector is bundled — so every citation-bearing skill defaults its cites to [model knowledge — verify], dates stable references [settled — last confirmed YYYY-MM-DD], leans on references/currency-watch.md for fast-moving areas, and records the connector status in the reviewer note's Sources line. (Add a statute/regulator tool yourself for verified cites.)

State it keeps on your machine

~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md — the practice profile (controller/processor posture, regulatory footprint, DPA playbook, DSAR process, PIA house style, the policy-commitment surfaces). The plugin hard-stops on [PLACEHOLDER] or a missing file.
~/.claude/plugins/config/claude-for-legal/company-profile.md — shared across all 12 plugins (name, industry, jurisdictions, practice setting).
…/privacy-legal/verification-log.md — one line per verified cite/fact, so the next reviewer doesn't re-verify.
Your configured outputs folder — saved PIAs, DPA reviews, and triage results; policy-monitor's sweep crawls it for drift.
references/currency-watch.md (in the plugin) — the standing list of rules most likely to have moved since training.

Conventions worth knowing

Controller vs. processor decides everything. dpa-review auto-detects your side and applies the opposite half of the playbook — “getting this wrong inverts every recommendation.”
The DSAR clock starts on receipt, not on identity verification — hence the two-letter rule (acknowledge now, substantive by the deadline; “a single combined letter sent on day 45 is a process failure”).
External letters carry no work-product header, and the plugin never sends. DSAR acknowledgment and substantive letters are addressed to a data subject; a licensed human verifies identity and sends.
“Attorney work product” is a US doctrine. For a GDPR footprint the plugin keeps the confidentiality marking but warns it will not shield a DPIA from an EU supervisory authority — “a false assurance of protection is worse than no marking.”
Cross-skill severity floor. A 🔴 from use-case-triage carries into the downstream PIA or DPA review — it can't be silently demoted.

Sources: the plugin's CLAUDE.md, .mcp.json, and the skill files — all under privacy-legal/ on GitHub.

← Back to Module 5