Privacy Surface Mapper

PM Handoff Entry Gate

Before privacy mapping, require a PM/Security handoff packet or equivalent confirmed data-scope context. If the user directly invokes this specialist without PM handoff context, confirmed data categories, or a confirmed feature_path for feature-scoped work, return the request to pm-agent for classification.

Use the PM-side packet definition in agents/product_manager/skills/idea-to-spec/_internal/_shared/skill-map.md.

Execution Steps

Step 1: Understand Data Requirements

1. Resolve feature scope:

• For feature-scoped privacy mapping, use the confirmed feature_path.
• Read docs/pm/{feature_path}/PRD.md.
• Read docs/engineer/{feature_path}/TRD.md and

docs/engineer/{feature_path}/IMPLEMENTATION_PLAN.md when architecture, storage, integrations, or release scope affect data handling.

• If feature_path is unclear, return to PM for PRD/path clarification or

Engineer for missing/stale TRD or implementation plan; do not invent a new top-level security directory.

1. Read PM documents:

• PRD: identify what user data is collected and why
• Extract data fields (name, email, phone, address, etc.)

Step 2: Map Data Collection Points

A. Find data collection code:

• Search for form inputs, API endpoints collecting user data
• Search for user registration/profile endpoints
• Search for analytics/tracking code

B. Classify data types:

• Personal Identifiable Information (PII): name, email, phone, address
• Sensitive data: health info, financial data, biometric data
• Behavioral data: browsing history, preferences, usage patterns

Step 3: Analyze Data Storage and Transmission

A. Storage:

• Where is data stored (database, files, cache)
• Is data encrypted at rest
• Data retention period

B. Transmission:

• Is data encrypted in transit (HTTPS)
• Third-party data sharing
• Cross-border data transfers

Step 4: Check User Rights Implementation

GDPR/CCPA requires:

• Right to access (data export)
• Right to deletion (data erasure)
• Right to rectification (data correction)
• Right to portability (data download)

Search for implementation of these features.

Step 5: Generate Privacy Map Report

Create docs/security/{feature_path}/privacy-map.md:

Frontmatter:

---
feature: {feature}
feature_path: {feature_path}
parent_feature: {parent_feature}
feature_level: {feature_level}
version: v1
date: YYYY-MM-DD
last_updated: YYYY-MM-DD
---

Report Structure:

1. Personal Data Inventory

• Table of all personal data collected
• Data type, purpose, legal basis

1. Data Flow Diagram

• Collection → Storage → Processing → Deletion

1. Third-Party Data Sharing

• List of third parties receiving data
• Purpose and legal basis

1. User Rights Implementation Status

• Access: ✅/❌
• Deletion: ✅/❌
• Export: ✅/❌
• Correction: ✅/❌

1. Privacy Risks

• Compliance gaps
• Missing consent mechanisms
• Inadequate data protection

1. Recommendations

• Priority fixes for compliance
• Privacy policy updates needed

Output Format

## Personal Data Inventory

| Data Field | Type | Purpose | Legal Basis | Retention |
|-----------|------|---------|-------------|-----------|
| Email | PII | Account login | Contract | Account lifetime |
| Name | PII | Personalization | Consent | Account lifetime |
| IP Address | PII | Security | Legitimate interest | 90 days |

## User Rights Status

- ✅ Right to Access: Implemented via /api/user/export
- ❌ Right to Deletion: Not implemented
- ❌ Right to Export: Partial (missing transaction history)
- ✅ Right to Correction: Implemented via profile edit

## Privacy Risks

### [HIGH] Missing Data Deletion Endpoint

**Issue:** No way for users to delete their account and data

**Compliance Impact:** GDPR Article 17 violation

**Fix:** Implement account deletion endpoint with cascading data removal

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Neplich
• Source: Neplich/dev-agent-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.