privacy-notice-generator

What this skill does

> **⚠️ EXPERIMENTAL** — This skill is provided for educational and informational purposes only. It does NOT constitute legal advice. All responsibility for usage rests with the user. Consult qualified legal professionals before acting on any output.

# Privacy Notice Generator

Tools and guidance for drafting GDPR-compliant privacy notices across EU/EEA jurisdictions and audience types, with multi-layer compliance verification.

---

## Table of Contents

- [Tools](#tools)
  - [Privacy Notice Scaffolder](#privacy-notice-scaffolder)
  - [Notice Compliance Checker](#notice-compliance-checker)
- [Reference Guides](#reference-guides)
- [Workflows](#workflows)
- [Troubleshooting](#troubleshooting)
- [Success Criteria](#success-criteria)
- [Scope & Limitations](#scope--limitations)
- [Anti-Patterns](#anti-patterns)
- [Tool Reference](#tool-reference)

---

## Tools

### Privacy Notice Scaffolder

Generates a privacy notice skeleton with all required sections pre-populated with jurisdiction-specific placeholders and legal references.

```bash
# Website privacy notice for German jurisdiction
python scripts/privacy_notice_scaffolder.py \
  --notice-type website \
  --jurisdiction DE \
  --data-categories personal,contact,usage,cookies \
  --legal-bases consent,contract,legitimate_interests \
  --has-cookies \
  --has-international-transfers

# Employee notice for French jurisdiction with AI processing
python scripts/privacy_notice_scaffolder.py \
  --notice-type employee \
  --jurisdiction FR \
  --data-categories personal,employment,financial,health \
  --legal-bases contract,legal_obligation,consent \
  --has-ai

# B2C customer notice for UK with all features
python scripts/privacy_notice_scaffolder.py \
  --notice-type b2c \
  --jurisdiction UK \
  --data-categories personal,contact,financial,usage,marketing \
  --legal-bases consent,contract,legitimate_interests \
  --has-cookies --has-ai --has-international-transfers \
  --json
```

**Supported Notice Types:**

| Type | Audience | Key Sections |
|------|----------|-------------|
| website | Website/app visitors | Cookies, analytics, tracking technologies |
| applicant | Job applicants | Recruitment data, talent pool, retention periods |
| employee | Employees | Works council, IT monitoring, BYOD, HR data |
| b2b | Business partners | Art. 14 requirements, source disclosure |
| b2c | B2C customers | Soft opt-in, payment processing, loyalty |
| combined | Multiple audiences | Merged sections with audience-specific callouts |

**Supported Jurisdictions:** DE, FR, AT, IT, ES, NL, BE, IE, UK

**13-Section Notice Structure:**
1. Controller identity and contact
2. DPO contact details
3. Data categories collected
4. Purposes and legal bases
5. Recipients and categories
6. International transfers
7. Retention periods
8. Data subject rights
9. Right to withdraw consent
10. Right to complain to SA
11. Automated decision-making
12. Cookies and tracking (if applicable)
13. AI processing (if applicable)

---

### Notice Compliance Checker

Validates a privacy notice text against Art. 13/14 GDPR requirements and generates a compliance score with missing/incomplete elements.

```bash
# Check a privacy notice file
python scripts/notice_compliance_checker.py privacy_notice.md

# Check with jurisdiction-specific requirements
python scripts/notice_compliance_checker.py privacy_notice.md --jurisdiction DE

# Check with notice type for type-specific validation
python scripts/notice_compliance_checker.py privacy_notice.md \
  --jurisdiction DE --notice-type employee

# JSON output
python scripts/notice_compliance_checker.py privacy_notice.md \
  --jurisdiction FR --notice-type website --json
```

**Checks For:**

| Category | Elements Checked |
|----------|-----------------|
| Art. 13 Mandatory | Controller identity, DPO contact, purposes, legal bases, recipients, transfers, retention, all 8 rights, automated decisions, consent withdrawal, SA complaint |
| Art. 14 Additional | Source of data, categories obtained (for indirect collection) |
| General | Art. 21 right to object prominence, plain language, no placeholders, consistent formatting |
| Jurisdiction-specific | DE: Widerspruchsrecht prominence, TDDDG; FR: CNIL recommendations; UK: ICO guidance |

**Output:**
- Compliance score (0-100)
- Missing elements (must-fix)
- Incomplete elements (should-improve)
- Jurisdiction-specific findings
- Type-specific findings

---

## Reference Guides

### Notice Types Guide
`references/notice_types_guide.md`

Detailed guidance for 6 notice types:
- Platform sub-types for website/app notices
- Applicant-specific data categories and retention
- Employee notice with works council and monitoring requirements
- B2B Art. 14 requirements and source disclosure
- B2C soft opt-in and payment processing
- Combined notice merge strategies

### Jurisdiction Requirements
`references/jurisdiction_requirements.md`

Jurisdiction-specific requirements for 9 jurisdictions:
- SA details and registration requirements
- Requirements beyond GDPR baseline
- Standard wording recommendations
- Retention guidance per jurisdiction

### Compliance Verification
`references/compliance_verification.md`

5-layer verification system:
- Jurisdiction-specific checks
- Art. 13/14 mandatory disclosures
- General compliance checks
- Type-specific checks
- AI Act compliance
- Post-generation checklist
- Writing style guide

---

## Workflows

### Workflow 1: SCOPE → INTAKE → DRAFT → VERIFY → DELIVER

```
Step 1: SCOPE — Determine notice parameters
        → Notice type (website/applicant/employee/b2b/b2c/combined)
        → Jurisdiction (DE/FR/AT/IT/ES/NL/BE/IE/UK)
        → Special features (cookies, AI, international transfers)

Step 2: INTAKE — Gather information
        → Controller identity and DPO
        → Data inventory (categories, sources)
        → Purposes and legal bases per category
        → Recipients and processors
        → Transfer destinations and mechanisms
        → Retention periods per category
        → Cookie/tracking inventory (if website)
        → AI processing details (if applicable)

Step 3: DRAFT — Generate notice skeleton
        → python scripts/privacy_notice_scaffolder.py [params]
        → Fill in placeholders with actual information from intake
        → Add jurisdiction-specific clauses
        → Apply writing style guide (you/your, short sentences, tables)

Step 4: VERIFY — Run compliance checker
        → python scripts/notice_compliance_checker.py notice.md --jurisdiction [J] --notice-type [T]
        → Address all missing elements
        → Address incomplete elements
        → Review jurisdiction-specific findings

Step 5: DELIVER — Finalize and publish
        → Legal review sign-off
        → Technical review (links, formatting, accessibility)
        → Translation QA (if multilingual)
        → Publication with version control
        → Set review trigger calendar
```

### Workflow 2: Notice Update

```
Step 1: Identify trigger (new processing, regulation change, annual review)
Step 2: Run compliance checker on current notice
Step 3: Identify gaps and required updates
Step 4: Draft updated sections
Step 5: Re-verify with compliance checker
Step 6: Notify data subjects of material changes
Step 7: Update version date and change log
```

### Workflow 3: Multi-Jurisdiction Notice

```
Step 1: Generate base notice for primary jurisdiction
        → python scripts/privacy_notice_scaffolder.py --jurisdiction [primary] ...
Step 2: Check jurisdiction requirements for additional territories
        → See references/jurisdiction_requirements.md
Step 3: Add jurisdiction-specific supplements
        → DE: TDDDG telecom disclosures, DSK guidance
        → FR: CNIL cookie requirements, LIL specifics
        → UK: ICO guidance, UK transfer mechanisms
Step 4: Verify each jurisdiction version
        → python scripts/notice_compliance_checker.py notice_de.md --jurisdiction DE
        → python scripts/notice_compliance_checker.py notice_fr.md --