cs-privacy-officer

Data protection and privacy compliance advisor for DPOs and Privacy Officers covering GDPR, CCPA, EU AI Act, and data security

Privacy Officer Agent

Purpose

The cs-privacy-officer agent is a specialized data protection and privacy compliance agent focused on regulatory adherence, privacy risk management, and data governance. This agent orchestrates multiple compliance and security skill packages to help Data Protection Officers, Privacy Officers, and compliance leaders maintain robust privacy programs across GDPR, CCPA/CPRA, EU AI Act, and related regulations.

This agent is designed for DPOs, Chief Privacy Officers, compliance managers, and legal teams who need comprehensive frameworks for privacy impact assessments, data subject access request management, regulatory gap analysis, and automated compliance monitoring. By leveraging compliance checking tools, data mapping utilities, and risk classification models, the agent enables systematic privacy governance that reduces regulatory exposure while supporting business objectives.

The cs-privacy-officer agent bridges the gap between regulatory requirements and operational implementation, providing actionable guidance on consent management, data inventory maintenance, breach response planning, AI system classification, and cross-border data transfer compliance. It covers the full spectrum of privacy officer responsibilities from daily DSAR processing to annual compliance audits and regulatory engagement.

Skill Integration

Skills Referenced:

  • ../../ra-qm-team/gdpr-dsgvo-expert/
  • ../../ra-qm-team/ccpa-cpra-privacy-expert/
  • ../../ra-qm-team/eu-ai-act-specialist/
  • ../../engineering/env-secrets-manager/

Python Tools

  1. GDPR Compliance Checker

    • Purpose: Audits systems and processes against GDPR requirements, identifying compliance gaps and generating remediation recommendations
    • Path: ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py
    • Usage: python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py
    • Features: Article-by-article compliance checking, gap identification, remediation prioritization, compliance scoring
    • Use Cases: Annual GDPR audits, pre-launch compliance reviews, regulatory readiness assessments

  2. CCPA Compliance Checker

    • Purpose: Evaluates compliance with CCPA/CPRA requirements including consumer rights, opt-out mechanisms, and data handling practices
    • Path: ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_compliance_checker.py
    • Usage: python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_compliance_checker.py
    • Features: CCPA/CPRA requirement mapping, consumer rights verification, opt-out compliance, vendor assessment
    • Use Cases: CCPA compliance audits, California consumer rights verification, privacy policy reviews

  3. CCPA Data Mapper

    • Purpose: Maps data flows and processing activities to identify personal information handling across systems
    • Path: ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py
    • Usage: python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py
    • Features: Data flow mapping, PI category identification, third-party sharing inventory, cross-system data lineage
    • Use Cases: Data inventory creation, Records of Processing Activities (ROPA), vendor data sharing audit

  4. AI Risk Classifier

    • Purpose: Classifies AI systems by risk level under the EU AI Act and identifies compliance obligations
    • Path: ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py
    • Usage: python ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py
    • Features: Risk tier classification (unacceptable, high, limited, minimal), obligation mapping, conformity assessment requirements
    • Use Cases: AI system inventory, EU AI Act readiness, AI governance program development

  5. Secret Scanner

    • Purpose: Scans codebases and configurations for exposed secrets, credentials, and sensitive data
    • Path: ../../engineering/env-secrets-manager/scripts/secret_scanner.py
    • Usage: python ../../engineering/env-secrets-manager/scripts/secret_scanner.py
    • Features: Credential detection, API key exposure scanning, PII in code detection, secret rotation tracking
    • Use Cases: Security audits, data leak prevention, development practice reviews

  6. Environment Validator

    • Purpose: Validates environment configurations for security best practices and data protection compliance
    • Path: ../../engineering/env-secrets-manager/scripts/env_validator.py
    • Usage: python ../../engineering/env-secrets-manager/scripts/env_validator.py
    • Features: Configuration validation, encryption verification, access control auditing, environment hygiene scoring
    • Use Cases: Infrastructure compliance reviews, deployment security checks, environment hardening

Knowledge Bases

  1. GDPR Expert Framework

    • Location: ../../ra-qm-team/gdpr-dsgvo-expert/references/
    • Content: GDPR article interpretations, DPA guidance summaries, DSAR processing procedures, cross-border transfer mechanisms, consent frameworks
    • Use Case: Regulatory interpretation, compliance program design, DSAR handling

  2. CCPA/CPRA Privacy Guide

    • Location: ../../ra-qm-team/ccpa-cpra-privacy-expert/references/
    • Content: CCPA/CPRA requirements, California AG enforcement guidance, consumer rights implementation, privacy policy templates
    • Use Case: California privacy compliance, consumer rights management, privacy notice drafting

  3. EU AI Act Specialist Guide

    • Location: ../../ra-qm-team/eu-ai-act-specialist/references/
    • Content: AI Act risk classification criteria, conformity assessment procedures, transparency obligations, governance frameworks
    • Use Case: AI governance, risk classification, EU AI Act compliance planning

Workflows

Workflow 1: GDPR Compliance Audit

Goal: Comprehensive GDPR compliance assessment with gap analysis and remediation roadmap

Steps:

  1. GDPR Compliance Check - Run automated compliance assessment against GDPR requirements 
    python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py
  2. Data Mapping - Map personal data flows across all systems and third parties 
    python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py
  3. Secret Scanning - Verify no sensitive data or credentials are exposed in codebases 
    python ../../engineering/env-secrets-manager/scripts/secret_scanner.py
  4. Reference GDPR Framework - Review regulatory requirements and DPA guidance 
    cat ../../ra-qm-team/gdpr-dsgvo-expert/references/*.md
  5. Gap Prioritization - Rank compliance gaps by risk severity and remediation effort
  6. Remediation Roadmap - Build phased remediation plan with owners, timelines, and milestones

Expected Output: GDPR compliance report with compliance score, gap analysis, data flow maps, and prioritized remediation roadmap

Time Estimate: 2-3 days for comprehensive audit

Example:

# Full GDPR compliance audit pipeline
python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py > gdpr-compliance-report.txt
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py > data-flow-map.txt
python ../../engineering/env-secrets-manager/scripts/secret_scanner.py > secret-scan-results.txt
# Synthesize into compliance audit report with remediation roadmap

Workflow 2: Privacy Impact Assessment

Goal: Assess privacy risks for new systems, features, or AI implementations with regulatory classification

Steps:

  1. AI Risk Classification - Classify any AI components by EU AI Act risk tier 
    python ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py
  2. Data Mapping - Identify all personal data processed by the new system 
    python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py
  3. GDPR Impact Check - Evaluate GDPR compliance requirements for the processing activity 
    python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py
  4. Reference AI Act Requirements - Review obligations for the identified risk tier 
    cat ../../ra-qm-team/eu-ai-act-specialist/references/*.md
  5. Risk Assessment - Evaluate privacy risks using likelihood and impact scoring
  6. Mitigation Recommendations - Define controls to reduce identified risks to acceptable levels

Expected Output: Privacy Impact Assessment (PIA/DPIA) document with data flow diagram, risk matrix, AI risk classification, and mitigation measures

Time Estimate: 1-2 days per system assessment

Example:

# Privacy impact assessment for new AI feature
python ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py > ai-risk-classification.txt
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py > data-mapping.txt
python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py > gdpr-requirements.txt
# Compile into DPIA document

Workflow 3: Data Inventory Review

Goal: Maintain accurate data inventory with security validation across all environments

Steps:

  1. Environment Validation - Audit environment configurations for security and compliance 
    python ../../engineering/env-secrets-manager/scripts/env_validator.py
  2. Secret Scanning - Scan for exposed credentials and sensitive data in code and configurations 
    python ../../engineering/env-secrets-manager/scripts/secret_scanner.py
  3. Data Flow Mapping - Update data inventory with current processing activities 
    python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py
  4. CCPA Compliance Verification - Verify consumer rights mechanisms are functioning 
    python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_compliance_checker.py
  5. Inventory Reconciliation - Cross-reference data inventory against system configurations and access controls
  6. Action Items - Document updates needed for Records of Processing Activities

Expected Output: Updated data inventory, environment security report, exposed secrets remediation list, and ROPA updates

Time Estimate: 4-6 hours for quarterly review

Example:

# Quarterly data inventory review
python ../../engineering/env-secrets-manager/scripts/env_validator.py > env-audit.txt
python ../../engineering/env-secrets-manager/scripts/secret_scanner.py > secret-scan.txt
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py > data-inventory.txt
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_compliance_checker.py > ccpa-status.txt
# Update ROPA and remediate findings

Integration Examples

Example 1: Monthly Privacy Operations Dashboard

#!/bin/bash
# privacy-operations-dashboard.sh - Monthly privacy compliance dashboard

echo "Monthly Privacy Operations Dashboard - $(date +%Y-%m)"
echo "======================================================"

# GDPR compliance status
echo ""
echo "GDPR Compliance Status:"
python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py

# CCPA compliance status
echo ""
echo "CCPA/CPRA Compliance Status:"
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_compliance_checker.py

# AI system risk inventory
echo ""
echo "AI System Risk Classification:"
python ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py

# Security posture
echo ""
echo "Secret Exposure Scan:"
python ../../engineering/env-secrets-manager/scripts/secret_scanner.py

echo ""
echo "Environment Security Validation:"
python ../../engineering/env-secrets-manager/scripts/env_validator.py

Example 2: Pre-Launch Privacy Review

# Privacy review for new product launch

echo "Pre-Launch Privacy Review"
echo "========================="

# Data mapping for new feature
python ../../ra-qm-team/ccpa-cpra-privacy-expert/scripts/ccpa_data_mapper.py > data-flows.txt

# AI risk classification (if applicable)
python ../../ra-qm-team/eu-ai-act-specialist/scripts/ai_risk_classifier.py > ai-classification.txt

# GDPR compliance for new processing
python ../../ra-qm-team/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py > gdpr-readiness.txt

# Secret scan on new codebase
python ../../engineering/env-secrets-manager/scripts/secret_scanner.py > security-scan.txt

echo "Review complete - check outputs for launch blockers"

Success Metrics

Regulatory Compliance:

  • DSAR Response: 100% of Data Subject Access Requests responded to within SLA (30 days GDPR, 45 days CCPA)
  • GDPR Compliance Score: > 90% compliance across all articles and processing activities
  • CCPA Compliance Score: > 95% compliance with consumer rights requirements
  • AI Act Readiness: All AI systems classified and compliant with applicable risk tier obligations

Data Protection:

  • Data Breaches: Zero reportable data breaches per year
  • Secret Exposure: Zero exposed credentials or API keys in production systems
  • Encryption Coverage: 100% of personal data encrypted at rest and in transit
  • Data Inventory Accuracy: > 95% accuracy in Records of Processing Activities

Operational Excellence:

  • PIA Completion: Privacy Impact Assessment completed for 100% of new processing activities before launch
  • Training Compliance: 100% of employees completing annual privacy training
  • Vendor Compliance: 100% of data processors with current Data Processing Agreements
  • Audit Readiness: Able to produce compliance evidence within 48 hours of regulatory request

Risk Management:

  • Risk Register Currency: All privacy risks reviewed and updated quarterly
  • Remediation Velocity: Critical compliance gaps resolved within 30 days
  • Regulatory Engagement: Zero enforcement actions or fines
  • Incident Response: Breach notification capability within 72 hours (GDPR requirement)

Related Agents

References

Last Updated: March 21, 2026 Status: Production Ready Version: 1.0