Implement Comprehensive Data Privacy Protections

The Data Privacy Engineer is an autonomous agent (Claude opus, tools: Read, Glob, Grep, Bash, WebSearch) that implements privacy protections, checks regulatory compliance, and embeds privacy-by-design principles into data processing systems. It scans the codebase and documentation for data processing activity, maps personal-data flows and third-party integrations, flags high-risk processing that needs a formal Data Privacy Impact Assessment (DPIA), and evaluates findings against GDPR, CCPA and related regulations - checking lawful-basis documentation, consent mechanisms, and data subject rights (access, rectification, erasure) - plus retention and deletion policies. It operates against a fixed set of guidelines rather than ad hoc judgment: proactive protection, privacy-as-default, purpose limitation, data minimization, transparency, accountability, continuous monitoring, a risk-based approach, user control, and alignment with security controls.

Use it to audit an existing codebase's data handling before a compliance review, to generate a privacy impact assessment for a feature that processes personal data, or to get concrete privacy-by-design patterns - data minimization, encryption/pseudonymization, purpose and storage limitation - implemented rather than just recommended. It is not a substitute for legal sign-off: it produces technical findings and draft artifacts (policy templates, consent forms, breach-notification workflow outlines), not a legally binding compliance certification.

Input is the target codebase and its documentation, read via the agent's Read/Glob/Grep/Bash/WebSearch tools. Output is a structured Privacy Compliance Report: an executive summary (compliance status GREEN/YELLOW/RED, counts of critical findings and recommended actions), a data-processing inventory, a risk assessment (high-risk activities, DPIA requirements, cross-border transfer implications, vendor compliance status), technical recommendations, and an implementation roadmap split into immediate (0-30 days), medium-term (1-6 months) and long-term (6+ months) actions. It also generates privacy-by-design code, for example:

# Privacy-by-Design Data Handler
class PrivacyAwareDataProcessor:
    def __init__(self, purpose, legal_basis, retention_period):
        self.purpose = purpose
        self.legal_basis = legal_basis
        self.retention_period = retention_period
        self.audit_log = []
    
    def process_data(self, data, user_consent=None):
        if not self.validate_purpose_limitation(data):
            raise PrivacyViolation("Data processing exceeds stated purpose")
        
        processed_data = self.minimize_data(data)
        self.log_processing_activity(processed_data)
        return self.pseudonymize_if_required(processed_data)

It connects to nothing external on its own - no GRC platform, consent-management vendor, or ticketing system. Everything it writes lands as plain text and code in the session for a human to review, commit and wire into whatever compliance tooling the organization already runs; enforcement and publication stay outside its scope entirely.

Teams that need to check GDPR/CCPA compliance on a data-processing system, generate a privacy impact assessment, or turn privacy-by-design controls - minimization, pseudonymization, purpose limitation - into concrete code and documentation rather than a generic checklist.