alexe-ev Assess Privacy, Security & Regulatory Risks
Purpose
Help product teams identify and evaluate privacy, security, and regulatory risks before they become problems.
Skill type
Conceptual skill
Use this skill when
- A new feature collects, stores, or processes personal data
- A product decision may have regulatory implications (GDPR, CCPA, HIPAA, etc.)
- Security risks in a product area need to be assessed
- A feature involves third-party data sharing or integrations
- A market expansion brings new regulatory requirements
Do not use this skill when
- The goal is a full legal or compliance audit (requires legal expertise)
- The goal is technical security architecture (requires security engineering)
Required inputs
- Feature or product decision being assessed
- Data types involved (personal data, financial, health, etc.)
- Target market/geography
Optional inputs
- Existing privacy or compliance documentation
- Known regulatory requirements
- Third-party integrations involved
- Data retention and access policies
Upstream context
Works best when:
- Feature requirements are defined
- Target market is known
Downstream handoff
Output can feed:
- plan-risk-mitigation (risks identified here become the input for mitigation planning)
- write-requirements-prd (privacy/security requirements feed product requirements)
Instructions
- Identify all personal, sensitive, or regulated data types involved.
- Identify applicable regulations by geography and data type.
- Assess privacy risks: data collection, storage, access, sharing, and retention.
- Assess security risks: attack surface, data exposure, access controls.
- Identify consent, transparency, and user rights requirements.
- Flag items that require legal or security engineering review.
Output
Provide:
- Data types and classification
- Applicable regulations
- Privacy risk assessment
- Security risk assessment
- Consent and transparency requirements
- User rights implications (right to access, delete, export)
- Items requiring legal or security review
- Recommended mitigations
Risks / caveats
- This skill does not replace legal or security review — it surfaces risks, not final answers
- Regulatory requirements vary by jurisdiction — always verify with legal
- Privacy risks often emerge later in development when they're harder to fix — assess early