How to use the Privacy Policy Drafter agent skill

What is an agent skill, and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent loads when a request matches the skill's description. The agent then follows that set process instead of improvising.

Once this skill is installed, the agent follows a set template to draft a privacy policy for a product or service. It asks for or researches the product's data practices, lists the data types collected, identifies which laws such as GDPR or CCPA may apply, and writes the policy in plain language. Sections that need a lawyer's judgment are marked with a warning label: [⚠️ LEGAL REVIEW REQUIRED].

• Maps direct, automatic and third-party data collection, plus any special categories such as health or children's data.
• Notes which laws may apply, including GDPR, CCPA/CPRA and some US state laws, plus industry rules such as HIPAA, GLBA and FERPA.
• Follows a 14-section template: information collected, use, legal basis, sharing, transfers, retention, user rights, cookies, security, children, contact, policy changes and additional provisions.
• Adds notes explaining why each section matters and what decisions the company must make.

How do you install the privacy-policy skill?

Download the ZIP for this skill from this page and unzip it. The skill is a single file, SKILL.md, so the unzipped folder should contain that file.

For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.

Alternatively, you can upload the skill in the Claude apps under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/
• Project install: the project's .claude/skills/ folder
• Claude apps: Settings → Capabilities → Skills, then upload

What do you need before you start?

This skill does not list any requirements. It does not run scripts and does not use the network, according to its listing. The only file it includes is SKILL.md.

Have the basic facts about your product ready. The skill accepts a product name, an optional product URL, your company's legal name and address, a privacy contact email, the types of data collected, and the jurisdictions you serve. Giving it more detail produces a more useful draft.

• Product name and a short description or URL
• Company legal name and registered or headquarters address
• A privacy contact email, such as privacy@company.com (the format the skill uses as an example)
• The types of data you collect, such as names, emails, usage behavior, location or payment information
• The jurisdictions your users are in, such as the United States, the EU (GDPR) or California (CCPA)

How do you trigger the skill with a natural request?

You do not need a special command. Describe what you need in ordinary words that match the skill's purpose: creating a privacy policy, updating data protection documentation, or preparing for compliance. Include your product details in the same message so the agent has what it needs.

If you give a product URL, the skill's process says the agent should visit the site and look for forms, tracking, logins, payments and third-party integrations. If you do not, it works from the details you provide.

• "Draft a privacy policy for my app, Acme Notes, a web product used by people in the EU and California."
• "Update our data protection documentation. We added payment processing and analytics."
• "Help me prepare a privacy policy for our mobile game before compliance review. The company is Example Labs Ltd."

What should the output look like?

The result is a draft policy in plain language, organised into standard sections. Each section that depends on jurisdiction or a legal decision carries the [⚠️ LEGAL REVIEW REQUIRED] label, so you can see at a glance what to take to a lawyer.

Treat the draft as a starting document. Check every fact against how your product actually works, because the skill can only describe the practices you or its research identify.

• Review each flagged section with a qualified privacy attorney.
• Confirm data retention periods, which the template leaves as placeholders such as X months, and fill in real values.
• Check that the list of third parties matches your actual integrations.

What are the safety notes and limits?

The skill states that it is for informational purposes only and does not constitute legal advice. It also states that privacy policies are legally binding documents and that professional legal review is essential before publication.

Generated text may be incomplete or wrong for a given jurisdiction. The skill is not suitable for regulated sectors such as health, finance or education that need specialist advice beyond its general industry notes.

Because the skill runs no scripts and uses no network access, it only produces text. It does not publish your policy or contact anyone on your behalf.

• Do not publish a policy without legal review.
• Do not rely on it alone for health, finance or education products.
• Always verify jurisdiction-specific clauses before relying on them.

What tips help you get a better draft?

Give specific answers. The template asks you to be concrete about purposes and retention, and vague inputs produce vague sections. Describe exactly which data you collect and why.

Run the skill again after product changes, such as adding analytics or a payment provider, and compare the new draft to the published policy.

• List every third-party tool, including analytics, payments and email.
• State whether you sell or share data. The template asks for an explicit statement either way.
• Note whether you serve children under 13, since that triggers extra review.