How to use the Privacy Use Case Triage agent skill

What is an agent skill, and what does this one make the agent do?

An agent skill is a folder containing a SKILL.md file that tells an AI agent how to carry out a specific task when you ask for it. This skill is part of the claude-for-legal privacy-legal plugin and is named use-case-triage.

When you describe a processing activity, the agent first reads your practice profile, then runs a triage: it checks your house trigger criteria, checks for mandatory assessments where GDPR applies, and checks for conflicts with your privacy policy commitments. It then explains its reasoning, lists conditions in a table where needed, notes any cross-plugin handoffs, and offers to start a full privacy impact assessment if one is required.

The skill does not write the full assessment. Its job is to decide whether one is needed and on what terms. The PIA generation skill does the deep work.

• PROCEED: no PIA needed, standard safeguards apply.
• PIA REQUIRED: an assessment is needed before or alongside deployment.
• DPIA MANDATORY: a regime-mandated data protection impact assessment is required. DPO or GC involvement is likely.
• STOP: the activity conflicts with the privacy policy or has no lawful basis as described, so it needs redesign.

Install the skill from the ZIP download

Download the ZIP for the skill from our page, then unzip it into one of two places. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

• Personal install: ~/.claude/skills/
• Project install: the .claude/skills/ folder inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Set up your practice profile before the first run

The skill reads a practice profile at ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md. The PIA trigger criteria, regulatory footprint and privacy policy commitments in that file are treated as authoritative. You create it by running the cold-start interview from the privacy-legal plugin.

If the profile is missing or still contains placeholders, the skill stops and points you to setup. You can instead say "provisional". The skill then runs against generic US defaults with no playbook, and tags every output [PROVISIONAL]. Use that mode only to see how the skill behaves. Its results will not reflect your organisation's actual commitments.

How do you trigger the skill with a natural request?

You can invoke the skill with its slash command and a description of the activity, or simply ask in plain language. The skill is designed to respond to requests such as "does this need a PIA", "triage this feature", "privacy check on X", "is this okay from a privacy perspective", or a description of a new data processing activity, product feature or vendor relationship.

The more specific you are, the better the triage. If your description is vague, the skill asks questions before classifying. Expect it to ask about the data categories, the data subjects, the purpose, whether data is new or being repurposed, whether a third-party vendor is involved, whether automated decisions affect anyone, and the deployment context.

• Does this need a PIA? Here is a feature that ...
• Triage this feature: it uses ... to ...
• Privacy check on our new vendor for ...
• Is this okay from a privacy perspective?

Read the output and the conditions table

The skill's output is a classification, its reasoning and, where a PIA is required, a conditions table. Read the reasoning rather than only the label, because it shows which house trigger or regime drove the result.

Treat the result as a triage decision for review. Outcomes that affect compliance should be reviewed by a qualified lawyer. The skill is not a legal opinion.

Safety notes: scripts, network and jurisdiction

The skill does not run scripts and does not use the network. It reads local configuration and writes outputs to the matter folder when matters are enabled. It only reads another matter's files if cross-matter context is switched on.

The classification assumes the jurisdiction in your configuration. Triggers and lawful bases vary by jurisdiction, so if the activity, controller or data subjects fall under a different country or sector regime, the result may not apply as written.

The skill also checks whether a destination is inside the privilege circle before producing output. If you name a public channel, a company-wide list, a vendor or opposing counsel, it will ask how you want the output handled rather than silently applying a privileged header.

Tips for better results

Run the triage before engineering work starts, since the skill is designed to tell you early whether a PIA is needed. Include the vendor name and the data categories in your first message to avoid clarifying questions.

Keep your practice profile current. The skill treats it as the source of truth, so out-of-date trigger criteria will produce out-of-date outcomes.

• Describe the data categories, data subjects and purpose in one message.
• Say whether data is new or being reused from an existing source.
• Ask for the reasoning, not just the label, so you can check the trigger that applied.
• If the skill mentions a federal overlay such as HIPAA, FERPA or COPPA, check that regime with a specialist.