How to use the Privacy Profile Customizer agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file that gives an AI agent specific instructions for one task. This skill, named customize, runs when you ask it to change part of your privacy practice profile without repeating the whole setup interview.

When it runs, the agent first checks that setup was already completed, then shows you the current values, asks what you want to change, explains which other privacy tools will be affected, and writes the change to the configuration file. It also flags inconsistencies in the profile and will refuse to shorten statutory DSAR deadlines below legal minimums.

• Customizable areas include company details, risk posture, people and escalation chain, DPA playbook, privacy policy commitments, PIA house style, DSAR process, workflow, and integrations.
• Shared company details such as name, industry, jurisdictions, and stage are written to company-profile.md and affect all 12 plugins.
• Regimes are never deleted. The skill marks them as not currently in scope instead.

Install the customize skill

You can install the skill in one of two ways. For Claude Code, download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to share it with one project. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

The skill is part of the claude-for-legal privacy-legal plugin, so the plugin must also be installed. The skill assumes your configuration files already exist in ~/.claude/plugins/config/claude-for-legal/, created by the cold-start interview.

• Download the ZIP from this page.
• Unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
• Confirm the claude-for-legal privacy-legal plugin is installed.

Check that setup is complete before you start

The skill reads ~/.claude/plugins/config/claude-for-legal/privacy-legal/CLAUDE.md and company-profile.md one level up. If the plugin config does not exist or still contains [PLACEHOLDER] values, the skill stops and tells you to run /privacy-legal:cold-start-interview first.

This skill is for adjusting a profile you already have. It does not replace the setup interview.

Trigger the skill with natural requests

You can invoke the skill with the slash command /privacy-legal:customize, optionally followed by a section name or a description of the change. You can also make a plain-language request. The skill's description lists phrases such as "change my [thing]", "update my profile", "edit my playbook", or "customize".

The agent will then list the customizable map and ask what you want to adjust. You can pick a section or describe the change in your own words.

• Change my risk posture to conservative.
• Update my profile so the sub-processor notice period is 14 days.
• Edit my playbook to add a new DSAR exemption.
• Customize my escalation contacts.

Make a change and review its effects

For each change, the agent shows the current value, asks for the new one, explains what changes downstream, asks you to confirm, and then writes it to the config. Each request should cover one change at a time, and the skill will not re-ask the whole interview.

The skill also explains how changes affect other tools. For example, changing a sub-processor notice period from 30 days to 14 days means /dpa-review will flag anything shorter than 14 days as a deviation, and existing DPAs stay as logged. Changing risk posture from middle to conservative means more activities are flagged for PIA escalation and stricter retention is recommended.

• Sub-processor notice 30 days to 14 days: /dpa-review flags notice periods shorter than 14 days as deviations.
• New DSAR exemption: /dsar-response surfaces it where the facts match.
• Risk posture middle to conservative: more PIA escalation, stricter SCC clauses, more conservative retention.

Understand the safety guardrails

The skill is built to keep the profile consistent. It warns when a change creates a tension, such as setting the profile to processor only while controller playbook positions remain active, or setting no EU nexus while SCCs remain in the default template.

Certain elements are protected and should not be removed: the [review] flag, source attribution tags, [verify] tags on cited regulations, and the DPIA-trigger mandatory check on /use-case-triage. If a change would set a statutory DSAR timeline below the regulatory minimum, the skill refuses and explains why.

The skill edits configuration only. It does not judge whether a change is lawful, so compliance decisions remain your responsibility.

• Edits are limited to configuration; they are not legal advice.
• The skill does not run scripts and does not use the network, according to its listing.