How to use the Privacy Impact Assessment Generator agent skill

What is an agent skill, and what does this one do?

An agent skill is a set of instructions that an AI assistant loads when a request matches it. This one is defined in a file called SKILL.md and is part of the claude-for-legal privacy-legal plugin.

The skill makes the agent work through a PIA as a structured conversation with the product team. A PIA asks what personal data a feature collects, why, how long it is kept, who can see it, and what could go wrong. The skill first checks whether a PIA is actually required under your team's house rules and applicable privacy laws. It then asks intake questions, or reads a product requirements document if you provide one. It checks for prior related work in your outputs folder, writes the assessment in your team's own format, and ends with a conditions list and named owners routed for sign-off.

• Checks whether a PIA is needed under house trigger criteria and applicable regimes
• Asks the product team intake questions, or pulls from a PRD if provided
• Looks for prior triage, PIA, or DPA review outputs on the same activity
• Writes the PIA using the house structure in your team's configuration
• Includes a privacy policy consistency check and a conditions list with owners

Install the pia-generation skill

Download the ZIP file from this page and unzip it. Then place the skill folder in one of these locations, depending on how you use Claude:

For a personal setup, put it in ~/.claude/skills/. For a single project, put it in the project's .claude/skills/ folder. If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

The skill is designed to run with the claude-for-legal privacy-legal plugin, so that plugin needs to be installed as well.

• Personal use: unzip into ~/.claude/skills/
• Project use: unzip into the project's .claude/skills/ folder
• Claude apps: upload the ZIP under Settings → Capabilities → Skills

Set up the configuration the skill depends on

The skill reads a practice-level CLAUDE.md file from your configuration folder. The source expects this file to contain your team's PIA house style, including what triggers a PIA, the structure template, typical depth, and who signs off. Without it, the skill cannot match your team's format.

The skill loads the file from this path, and reads its sections named PIA house style and Outputs. It also reads the Matter workspaces section, which is turned off by default for in-house users.

• Practice-level CLAUDE.md with the team's PIA house style and trigger criteria
• Outputs folder path listed under the Outputs section, for finding prior work
• Optional: a product requirements document (PRD) for intake

Trigger the skill with a natural request

You do not need to remember a command. The skill description lists phrases that should activate it, such as asking to write a PIA, asking whether a PIA is needed for something, or asking for a privacy review of a feature. You can also describe a new data processing activity directly.

The source also shows an explicit slash-command form, using the plugin namespace and an optional feature name in quotes. Passing a PRD link is also shown in the source.

• "Write a PIA for the new location sharing feature"
• "Do we need a PIA for this?" followed by a description of the feature
• "Privacy review this feature" with the feature summary
• "Privacy impact assessment for our new onboarding survey"

Work through an example session

Start with a clear feature name or description. The skill will first decide whether a PIA is needed. If the house trigger and the statutory triggers do not apply, it says so and stops. If a PIA is needed, it asks the product team questions about data collected, purpose, retention, access, and risks.

If you have a PRD, you can point the skill to it so that intake questions are drawn from the document rather than asked from scratch. The skill notes any prior work on the same activity, and if it finds a prior PIA it explains what carried over and what changed.

• Expect a draft, not a final opinion
• Have the reviewing lawyer check cited sources, especially those tagged for verification
• Keep the conditions list and named owners in the output for sign-off

Safety notes: scripts and network access

According to the listing, this skill does not run scripts. It does use the network: it queries a configured legal research tool to check regulatory assessment triggers, and the source says it may fall back to web search if that tool returns thin results.

Web search results are tagged in the output as needing verification. The skill is designed not to fill gaps from web search or model knowledge without asking you first. Treat any tagged citation as unverified until you check it against a primary source.

• No scripts are run by this skill, according to the listing
• Network use is yes: a legal research tool is queried
• Web search fallback is offered only after you are asked, and results are tagged [web search — verify]
• Check destination before sharing output, since the skill asks whether the destination is inside the privilege circle

Tips for better results

The quality of the draft depends heavily on the configuration. A detailed house-style section and clear trigger criteria in your CLAUDE.md let the skill produce a PIA that looks like your other PIAs. Feeding in a PRD gives the intake stage more to work with.

The skill also treats output as a draft. The source says the analysis relies on research that may be incomplete or out of date, and that analysis may not apply as written outside the jurisdiction configured for your team.

• Fill in the PIA house style section with a real seed PIA structure
• Keep prior triage and PIA outputs in the outputs folder so the skill can reconcile them
• Confirm the jurisdiction in your configuration matches the processing you are assessing
• Name a specific legal research tool in your configuration if you have one, since the skill does not name a product