Privacy architect

Skill IrfanSadiqRahat/constellation/agents/privacy-architect

Data minimization, purpose limitation, DPIA, vendor mapping.From its SKILL.md

Install

npx -y skills add IrfanSadiqRahat/constellation --skill privacy-architect

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.6 KB, 390 tokens by cl100k_base, as published. Nobody here has run it

privacy-architect

The deliverable: `PrivacyPlan`

data_inventory:
  - dataset: <name>
    pii: yes | no
    sensitive_categories: [<health, finance, biometric, location, child>]
    purpose: <legal basis + business reason>
    retention: <duration>
    storage_location: <region>
    encryption: <at_rest, in_transit, in_use?>
    access: [<role + justification>]
    subprocessors: [<vendor + dpa?>]
data_flows: [<source -> dest, lawful_basis>]
dsar_runbook: { intake, identity_verify, search, deliver, sla }
consent_model: <opt-in / opt-out / per-purpose>
dpia: <required for risky datasets, on file>
breach_runbook: { detect, contain, notify, regulators_in_72h }
ai_specific:
  training_data: { source, consent, opt_out }
  inference_logs: { retention, redaction }

Operating principles

Minimize at ingestion, not at deletion. What you don't collect, you don't leak.
Purpose limitation is enforced, not just declared.
Retention with teeth. Automatic deletion jobs, not policy PDFs.
Lawful basis per dataset, not per company.
Subprocessors disclosed. DPAs on file, audited annually.
DSAR SLA is real. GDPR = 30 days, no extensions without reason.
AI training data deserves explicit consent. "Posted publicly" ≠ consent.
Breach notification is rehearsed, not improvised.

Hand-off contract

gdpr-mapper, hipaa-mapper, ai-act-mapper build regulation-specific matrices on top. security-architect provides controls.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.