When to use
Use this once per organization (and whenever its footprint changes) to record the context every other privl- skill needs: which laws apply, the controller/processor role, the sensitive-data footprint, the escalation thresholds, and who counsel is. It converts generic privacy skills into org-specific ones.
Not for: doing the substantive work (triage, PIA, DSAR, DPA), or a one-off assessment. This is the configuration layer, not an assessment.
Method
- Capture jurisdiction and applicable regimes: GDPR/UK GDPR, CCPA/CPRA and other US state laws, sector rules (HIPAA, GLBA, COPPA), and any others by geography of subjects.
- Record the org's role(s): controller, processor, or both, and for which product lines — this changes which obligations and DPA clauses apply.
- Map the sensitive-data footprint: special-category data, children's data, financial/government IDs, and whether AI/automated decisioning is in use.
- Define the escalation matrix: what always goes to counsel (refusals, new automated decisioning, sensitive-data monetization, unmechanized transfers), what a privacy lead can clear, and named contacts + SLAs.
- Set defaults each skill inherits: DSAR verification standard, retention baselines, breach-notification thresholds, and risk-appetite for legitimate-interest reliance.
- Decision point: where the org's stated risk appetite conflicts with legal minimums, the legal minimum wins — record the tension for counsel.
- Attorney-escalation gate: counsel must sign off on the escalation matrix itself — the thresholds that decide when to involve them are a legal decision.
Example
Org: B2B SaaS, EU + California customers, controller for its app / processor for customer data it hosts.
Sensitive: no Art. 9 data; uses an AI support-summarizer (automated, non-decisioning).
Escalation: all refusals + any move to automated decisioning → counsel (48h SLA); privacy lead clears routine access DSARs.
Defaults: DSAR ID = account challenge; LI reliance allowed with balancing test on file.
Pitfalls
- Guessing the regime footprint instead of mapping it to actual subject geography.
- Recording a single role when the org is controller for one product and processor for another.
- Setting a risk appetite that undercuts a legal minimum and treating it as authorization.
- Letting the org self-set escalation thresholds without counsel sign-off.
Output format
PRIVL CONFIG — <org> | date | counsel-approved: <y/n>
Regimes: <GDPR/CCPA/sector...>
Role(s): <controller/processor per product line>
Sensitive footprint: <Art.9 / children / financial / AI-decisioning>
Escalation matrix: <always-counsel | lead-can-clear | contacts + SLA>
Defaults: <DSAR verification | retention | breach threshold | LI appetite>
Legal-minimum conflicts: <items for counsel>
Reference
- GDPR Art. 3 territorial scope; Art. 4(7)/(8) controller vs. processor definitions.
- CCPA/CPRA business/service-provider/contractor roles and applicability thresholds; other US state laws by subject residence.
- Sector overlays: HIPAA, GLBA, COPPA.
- The escalation matrix and any legal-minimum conflict must be approved by an attorney.
1---2name: privl-customize3description: Tailor the privacy-legal skill set to a specific organization — capture its regimes, roles, risk appetite, and escalation rules so every privl- skill runs against the right context.4---56## When to use78Use this once per organization (and whenever its footprint changes) to record the context every other privl- skill needs: which laws apply, the controller/processor role, the sensitive-data footprint, the escalation thresholds, and who counsel is. It converts generic privacy skills into org-specific ones.910**Not for:** doing the substantive work (triage, PIA, DSAR, DPA), or a one-off assessment. This is the configuration layer, not an assessment.1112## Method13141. Capture jurisdiction and applicable regimes: GDPR/UK GDPR, CCPA/CPRA and other US state laws, sector rules (HIPAA, GLBA, COPPA), and any others by geography of subjects.152. Record the org's role(s): controller, processor, or both, and for which product lines — this changes which obligations and DPA clauses apply.163. Map the sensitive-data footprint: special-category data, children's data, financial/government IDs, and whether AI/automated decisioning is in use.174. Define the escalation matrix: what always goes to counsel (refusals, new automated decisioning, sensitive-data monetization, unmechanized transfers), what a privacy lead can clear, and named contacts + SLAs.185. Set defaults each skill inherits: DSAR verification standard, retention baselines, breach-notification thresholds, and risk-appetite for legitimate-interest reliance.196. **Decision point:** where the org's stated risk appetite conflicts with legal minimums, the legal minimum wins — record the tension for counsel.207. **Attorney-escalation gate:** counsel must sign off on the escalation matrix itself — the thresholds that decide when to involve them are a legal decision.2122## Example2324> **Org:** B2B SaaS, EU + California customers, controller for its app / processor for customer data it hosts.25> **Sensitive:** no Art. 9 data; uses an AI support-summarizer (automated, non-decisioning).26> **Escalation:** all refusals + any move to automated decisioning → counsel (48h SLA); privacy lead clears routine access DSARs.27> **Defaults:** DSAR ID = account challenge; LI reliance allowed with balancing test on file.2829## Pitfalls3031- Guessing the regime footprint instead of mapping it to actual subject geography.32- Recording a single role when the org is controller for one product and processor for another.33- Setting a risk appetite that undercuts a legal minimum and treating it as authorization.34- Letting the org self-set escalation thresholds without counsel sign-off.3536## Output format3738```39PRIVL CONFIG — <org> | date | counsel-approved: <y/n>40Regimes: <GDPR/CCPA/sector...>41Role(s): <controller/processor per product line>42Sensitive footprint: <Art.9 / children / financial / AI-decisioning>43Escalation matrix: <always-counsel | lead-can-clear | contacts + SLA>44Defaults: <DSAR verification | retention | breach threshold | LI appetite>45Legal-minimum conflicts: <items for counsel>46```4748## Reference4950- **GDPR Art. 3** territorial scope; **Art. 4(7)/(8)** controller vs. processor definitions.51- **CCPA/CPRA** business/service-provider/contractor roles and applicability thresholds; other US state laws by subject residence.52- Sector overlays: **HIPAA**, **GLBA**, **COPPA**.53- The escalation matrix and any legal-minimum conflict must be approved by an attorney.
Matrixx0070