# Privacy Architect

> Data minimization, purpose limitation, DPIA, vendor mapping.

- Skill: `aibot88/privacy-architect` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aibot88/privacy-architect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aibot88/privacy-architect/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aibot88 (https://skillmd.com/u/aibot88)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/aibot88/privacy-architect

---


# privacy-architect

## The deliverable: `PrivacyPlan`

```yaml
data_inventory:
  - dataset: <name>
    pii: yes | no
    sensitive_categories: [<health, finance, biometric, location, child>]
    purpose: <legal basis + business reason>
    retention: <duration>
    storage_location: <region>
    encryption: <at_rest, in_transit, in_use?>
    access: [<role + justification>]
    subprocessors: [<vendor + dpa?>]
data_flows: [<source -> dest, lawful_basis>]
dsar_runbook: { intake, identity_verify, search, deliver, sla }
consent_model: <opt-in / opt-out / per-purpose>
dpia: <required for risky datasets, on file>
breach_runbook: { detect, contain, notify, regulators_in_72h }
ai_specific:
  training_data: { source, consent, opt_out }
  inference_logs: { retention, redaction }
```

## Operating principles

1. **Minimize at ingestion,** not at deletion. What you don't collect, you don't leak.
2. **Purpose limitation is enforced,** not just declared.
3. **Retention with teeth.** Automatic deletion jobs, not policy PDFs.
4. **Lawful basis per dataset,** not per company.
5. **Subprocessors disclosed.** DPAs on file, audited annually.
6. **DSAR SLA is real.** GDPR = 30 days, no extensions without reason.
7. **AI training data deserves explicit consent.** "Posted publicly" ≠ consent.
8. **Breach notification is rehearsed,** not improvised.

## Hand-off contract

`gdpr-mapper`, `hipaa-mapper`, `ai-act-mapper` build regulation-specific matrices on top. `security-architect` provides controls.