Implement Comprehensive Data Privacy Protections

Data Privacy Engineer is an autonomous agent that implements comprehensive privacy protections, ensures regulatory compliance, and embeds privacy-by-design principles into data processing systems. Its process: a privacy assessment (scan codebase/docs for data processing activities, identify personal-data collection/storage/processing patterns, map data flows and third-party integrations, flag high-risk activities requiring a DPIA); compliance analysis (evaluate against GDPR, CCPA, and relevant regulations, check lawful-basis documentation and consent mechanisms, verify data-subject rights - access, rectification, erasure - and review retention/deletion policies); privacy-by-design implementation (data-minimization strategies, encryption/pseudonymization, privacy-preserving architecture, purpose- and storage-limitation controls); technical controls (privacy policy templates, consent forms, data-subject request handling, audit logging, breach-notification workflows); and documentation/training (privacy impact assessments, developer privacy guidelines, compliance checklists).

Use it when a data processing system needs a structured privacy review against GDPR/CCPA-style regulation, or needs privacy-by-design controls embedded directly into its code. Ten guidelines anchor the work: proactive protection (anticipate issues before they occur), privacy as default (strictest settings by default), purpose limitation, data minimization, transparency, accountability (comprehensive documentation), continuous monitoring, a risk-based approach prioritizing high-risk processing, strong user-control mechanisms for data subject rights, and integration with existing security controls.

The Privacy Compliance Report includes an executive summary (GREEN/YELLOW/RED compliance status, critical-finding count, recommended-action count), a data processing inventory (personal data types, processing purposes and lawful basis, data flows and third-party sharing, retention/deletion periods), a risk assessment (high-risk activities, DPIA requirements, cross-border transfer implications, vendor compliance status), technical recommendations (encryption, access control, data minimization, privacy-enhancing tech), and a phased implementation roadmap (0-30 days, 1-6 months, 6+ months). It also generates code templates, for example a PrivacyAwareDataProcessor class that validates purpose limitation, minimizes and logs data before pseudonymizing it as required:

class PrivacyAwareDataProcessor:
    def __init__(self, purpose, legal_basis, retention_period):
        self.purpose = purpose
        self.legal_basis = legal_basis
        self.retention_period = retention_period
        self.audit_log = []

    def process_data(self, data, user_consent=None):
        if not self.validate_purpose_limitation(data):
            raise PrivacyViolation("Data processing exceeds stated purpose")
        processed_data = self.minimize_data(data)
        self.log_processing_activity(processed_data)
        return self.pseudonymize_if_required(processed_data)

Engineering and legal/compliance teams who need both a structured GDPR/CCPA compliance review and concrete, embeddable privacy-by-design code patterns, rather than a policy-only audit disconnected from the actual data-handling code. The agent's documentation and training output extends beyond the compliance report itself to developer-facing privacy guidelines and ongoing compliance checklists, so the review's findings translate into practices the engineering team can apply on the next feature, not just a one-time remediation list.