Privacy Engineer

Privacy Engineer — Privacy Engineering Pipeline

Systematically builds a service's privacy protection framework from legal analysis through process design.

Execution Mode

Agent Team — 4 agents communicate directly via SendMessage and perform cross-validation.

Agent Composition

Workflow

Phase 1: Preparation (Orchestrator performs directly)

1. Extract from user input:
   • Service name/type: web, app, SaaS, e-commerce, etc.
   • Data processed: personal data items collected
   • User regions: domestic, EU, US, etc.
   • Service scale: number of users, data volume
   • Existing materials (optional): current privacy policy, consent forms, system architecture diagrams
2. Create a _workspace/ directory at the project root
3. Organize inputs and save to _workspace/00_input.md
4. Determine execution mode based on request scope

Phase 2: Team Assembly and Execution

Steps 3a (consent) and 3b (process) run in parallel. Both depend on legal analysis and PIA, so they can start simultaneously after Step 2 completes.

Inter-agent communication flow:

• privacy-law-analyst completes → sends processing activity list and risk factors to pia-assessor
• pia-assessor completes → sends disclosure requirements to consent-designer, sends safeguard recommendations to process-architect
• consent-designer → sends consent collection timing and management requirements to process-architect
• process-architect cross-validates logical consistency across all outputs during final design

Phase 3: Integration and Final Deliverables

1. Review all files in _workspace/
2. Verify consistency across legal analysis → PIA → consent forms → process design
3. Report final summary to user:
   • Legal analysis report — 01_privacy_law_analysis.md
   • PIA report — 02_pia_report.md
   • Consent forms and notices set — 03_consent_documents.md
   • Process design document — 04_process_design.md

Modes by Task Scope

Data Handoff Protocol

File naming convention: {sequence}_{agent}_{deliverable}.{extension}

Error Handling

Test Scenarios

Normal Flow

Prompt: "Design a privacy protection framework for a SaaS service that includes EU users. We process registration, payment, and marketing data." Expected result:

• Legal analysis: simultaneous GDPR + PIPA application, mapping 10+ processing activities
• PIA: 15+ risk assessments, safeguard recommendations
• Consent forms: required/optional separation, GDPR valid consent requirements reflected, cross-border transfer consent
• Process: full lifecycle, technical safeguards, incident response framework

Partial Flow

Prompt: "Just write a personal data collection consent form for our app" Expected result:

• Switches to consent mode (consent-designer only)
• Drafts based on standard consent form template, notes that specific items require confirmation

Error Flow

Prompt: "Design a privacy protection framework — we're a startup and don't know where to start" Expected result:

• Full pipeline executes, asks follow-up questions due to insufficient service information
• Proceeds with assumptions based on typical startup baseline, notes "requires review once service details are confirmed"
• Prioritizes minimum legal obligations (publishing privacy policy, obtaining consent) as first steps

Per-Agent Extended Skills