Hire an AI data privacy officer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A table of the duties that apply, with the rule behind each and the proof you have
• A list of missing evidence and the questions you still need to answer
• A fix list in order, with how big each job is
• A list of points to take to a privacy lawyer

How it does the job well

• State rules as you know them. Say "check this against the law's current text" for article numbers, deadlines, thresholds and fines. Never present a figure from memory as settled.
• Never write "compliant" or "lawful" without evidence. Mark each duty Seen (in the user's documents), Not seen (documents given, nothing found) or Not supplied.
• This is not a legal opinion. Name each point that needs a qualified privacy lawyer.
• Minimize first. Always challenge whether data is necessary before advising on how to protect it. Collecting less is the strongest privacy control there is.
• Establish a lawful basis before processing — every time. No personal data is processed without a documented, appropriate lawful basis. Never default to consent where it's fragile or coerced.
• Privacy by design, not bolted on. High-risk processing requires a DPIA *before* launch. Never advise shipping first and assessing later.
• Honor the breach clock. GDPR's 72-hour notification window starts at awareness of a reportable breach. Never advise delaying assessment or concealing an incident to avoid reporting.

Mistakes it avoids

• Advising anyone to delay a breach assessment, hide an incident or ignore a valid customer request.
• Reviewing a whole company at once. Ask the user to pick one activity.
• Treating every business as a large company with a privacy team.
• Copying the profile's sample tables as if they were the user's facts.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.

What a good result looks like

An example, not your task: You plan to add a sign-up form, tracking pixel or customer database and want to know which privacy duties it brings.

• Scope. The activity reviewed, who is affected, where they live and which laws were tested.
• Data need check. Each data item with why you need it, and any you could drop or keep for less time.
• Duties table. Each duty with the rule in one line, whether it applies, and the proof seen or missing.
• Evidence gaps. What is missing, which duty it limits and how to get it.
• Fix list. Actions in order, each marked small, medium or large, with who should do it.
• Questions for your privacy lawyer. Points the AI cannot settle, with what the lawyer should confirm.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Fix the scope. It confirms the one activity, who is affected and where they live. Anything missing is asked once, then marked MISSING.
• Question the need. For each data item it asks why you need it. It lists what you could drop or keep for less time.
• Find the legal reason. It matches each purpose to a lawful basis, the legal reason to use the data. It warns when consent is a weak choice.
• Test the duties. It goes through records, risk checks, customer requests, breach steps, vendor contracts and transfers. It says if each applies, does not apply or is unclear.
• Match the proof. Each duty is marked Seen, Not seen or Not supplied, based only on what you gave it.
• Rank and hand back. It orders the fixes, then lists what a privacy lawyer should decide.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id data-privacy-officer only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/data-privacy-officer/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• One way you use personal data, in a few lines. Say what you collect, from whom, why, who receives it and how long you keep it.
• Where your customers or staff live, such as the EU, the UK or California. This decides which laws apply.
• Your privacy notice, vendor contract or data list (optional)
• Your business size, and whether the data is sensitive, such as health, children's or payment data (optional)

Helpful context (optional)

• A list of the vendors that touch the data, and the country each one stores it in.
• How long you keep each kind of data today.
• Any past risk checks or logs of customer requests.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It reads your privacy notice and vendor contracts next to your description, and can tie each duty to a line in them.

Functions and deliverables

• Data privacy officer: Review one way you use customer data under GDPR or CCPA. Get the duties that apply, the proof you lack and what to fix first.
  • A table of the duties that apply, with the rule behind each and the proof you have
  • A list of missing evidence and the questions you still need to answer
  • A fix list in order, with how big each job is
  • A list of points to take to a privacy lawyer
  Source: Michael Sitarzewski and Agency Agents contributors.
• California privacy law checker: Check if California privacy law applies to your business. Describe your data use. You get a yes or no, your duties, gaps and a plan for requests.
  • A yes or no on whether the law applies
  • A list of duties that apply to you
  • Gaps to close
  • A plan for handling consumer requests
  Source: Hemant Naik.
• GDPR audit prep coach: Get a GDPR audit prep check before a review. Name your scope, answer six article-based questions and see the privacy gaps to fix first.
  • Six questions tied to GDPR articles
  • What evidence would satisfy each one
  • A list of gaps ranked by risk
  • Fix steps before the review
  Source: Alireza Rezvani.
• Brazil data privacy checker: Check your LGPD compliance for Brazil. Describe how you handle personal data and get a gap table, legal bases and a fix plan.
  • A gap table with priority and action
  • Legal basis for each data use
  • Step-by-step rights request workflow
  • Breach notification checklist
  • Penalty exposure notes
  Source: Hemant Naik.
• me.md builder: Answer a few questions, or let your AI use what it remembers. Get one private file that tells any AI who you are.
  • One me.md file with up to ten dated sections
  • A list of facts taken from memory, for you to check
  • A short note of what it removed for privacy
  • The two next steps, to save it and set it up

Tasks you can use it for

• You plan to add a sign-up form, tracking pixel or customer database and want to know which privacy duties it brings.
• A customer asks you to send or delete their data and you are not sure what you must do, or by when.
• You are about to sign with a vendor who will hold your customer data and want to know what the contract must cover.
• A buyer, partner or investor asks how you handle personal data and you have nothing written down.

Limits to check before starting

• You need a legal opinion, or a paper to file with a regulator. Take its questions to a privacy lawyer instead.
• You want your code and data use checked for GDPR risks. Use the GDPR privacy checker.
• You want an evidence checklist for SOC 2 or ISO 27001. Use the Compliance Auditor agent.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill. If you cannot, paste SKILL.md into a new chat, then paste references/source-agent.md.
• Describe one data activity in plain words. Say what you collect, from whom, why, who receives it and how long you keep it.
• Say where your customers live. Attach your privacy notice or vendor contract if you have one. No code or web access is needed.
• Type "Review this. Show what you saw for each duty. Do not call anything compliant without proof."
• Read the evidence gaps first. Fill in what you can, then ask it to run the review again.
• Take the lawyer questions to a privacy lawyer before you act. Check any article number it quotes against the law's own text.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/data-privacy-officer for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.