Privacy By Design

MicrosoftOfficialPublished by Microsoft

Skill
Guidelines
Security
CC-BY-4.0
No issues found

From the author

Privacy by Design (PbD) knowledge base for assessing proactive privacy practices against the 7 Foundation Principles, with data retention and disposal lifecycle checks and cross-jurisdictional mappings (GDPR, CCPA, APP).

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The Privacy by Design (PbD) skill provides a comprehensive knowledge base and assessment protocol for evaluating software systems against the 7 Foundation Principles established by Dr. Ann Cavoukian. It enables users to conduct proactive privacy reviews, identify deficiencies, and map findings to regulatory requirements including GDPR, CCPA/CPRA, and Australian Privacy Principles. The skill includes structured checklists, implementation patterns, and a finding schema to ensure consistent, evidence-based privacy assessments across the development lifecycle.

What it does

Assesses system designs against the 7 Foundation Principles of Privacy by Design.
Provides a structured protocol for conducting privacy impact assessments.
Maps privacy findings to GDPR, CCPA/CPRA, and Australian Privacy Principles.
Evaluates data retention, disposal, and lifecycle management practices.
Identifies privacy-related anti-patterns in architecture and configuration.
Generates actionable remediation items for identified privacy deficiencies.

When to use it

During the design phase of a new system or feature involving personal data.
When performing a proactive privacy audit to identify potential compliance gaps.
To verify that privacy controls are embedded into the architecture rather than added post-deployment.
When establishing data retention and disposal schedules for sensitive information.
To generate structured privacy assessment reports for stakeholders.

Advantages

Promotes a proactive, preventative approach to privacy rather than reactive compliance.
Standardizes privacy assessments using a clear, evidence-based schema.
Facilitates cross-jurisdictional compliance mapping.
Integrates privacy considerations directly into the software development lifecycle.
Provides clear, actionable remediation guidance for identified risks.

Usage examples

“Assess our new user registration flow against the 7 Privacy by Design principles.”: The agent will walk through each of the 7 principles, checking for proactive design, default privacy settings, and end-to-end security, ultimately providing a compliance verdict and specific remediation steps.
“Check our data retention policy for compliance with PbD-05.”: The agent will evaluate the current retention and disposal lifecycle against Principle 05, identifying gaps in data minimization or legal hold procedures and suggesting improvements.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/privacy-by-design/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip privacy-by-design.zip -d .agents/skills

Documentation by Microsoft

Privacy by Design

This SKILL.md is the entrypoint for the Privacy by Design skill.

The skill provides structured assessment references for the 7 Foundation Principles of Privacy by Design (Cavoukian, 2009). Consumers that explicitly load it can assess privacy practices across the software lifecycle. It complements privacy-standards with principle-level criteria, retention and disposal checks, regulatory mappings, a finding schema and implementation patterns. Current agent wiring is described under Integration below.

[!NOTE] This skill is a planning aid, not legal advice. Its standards summaries support privacy reasoning and review preparation; they do not substitute for qualified legal counsel or a formal regulatory interpretation.

Goal

Produce an evidence-based assessment against the 7 PbD Foundation Principles, with per-principle verdicts, explicit evidence gaps, deficiency severity, and remediation for established deficiencies. Assessment labels describe this planning rubric, not legal certification.

Success criteria

All 7 principles have a verdict, evidence completeness, and severity (N/A when no deficiency is established).
Each FAIL or PARTIAL finding includes a specific, actionable remediation.
Findings use the structured schema defined in finding-schema.md.
Cross-jurisdictional obligations are identified for the applicable regulatory scope.
Retention and disposal are assessed for any system that stores personal data.
An overall assessment verdict (COMPLIANT / PARTIALLY_COMPLIANT / NON_COMPLIANT / INCOMPLETE) is determined without treating missing evidence as a failed control.
Finding, principle, checklist and severity counts reconcile under the finding schema.

When to use this skill

Use when you need to:

Assess a system, feature, or data flow against the 7 PbD Foundation Principles
Verify that privacy is embedded proactively (not bolted on after incidents)
Check data retention schedules, disposal methods, and legal hold procedures
Map privacy requirements across GDPR Art. 25, CCPA/CPRA, and Australian Privacy Principles
Generate per-principle PASS/PARTIAL/FAIL/INSUFFICIENT_EVIDENCE results with evidence-backed severity
Identify code-level and configuration-level privacy patterns or anti-patterns
Produce backlog items from privacy assessment findings

Do not use for:

General privacy standards mapping without principle assessment (use privacy-standards)
Security threat modeling (use security-planning or OWASP skills)
RAI assessment (use rai-planner)
Legal advice or regulatory compliance certification

Stop rules

Stop the assessment if the system boundary cannot be established.
Stop and escalate if processing occurs in a jurisdiction not covered by this skill's mappings.
Do not fabricate evidence; record INSUFFICIENT_EVIDENCE and the evidence needed. Continue supported checks without inventing deficiency remediation for unknowns.
Do not provide legal opinions; frame all findings as planning guidance requiring qualified review.
Do not duplicate security findings that the security-planning skill already covers; cross-reference them.

Normative references (PbD 7 Foundation Principles)

Operational references

Assessment Protocol — step-by-step protocol for conducting a PbD assessment
Finding Schema — structured output format for findings and backlog handoff
Implementation Patterns — pragmatic code-level and architecture-level verification patterns

Supplementary references

Data Retention and Disposal — Principle 05 deep-dive: retention schedules, disposal methods, legal holds
Cross-Jurisdictional Mapping — regulatory equivalence matrix across GDPR, CCPA/CPRA, and APP
Industry Privacy Profiles — sector-specific principle priorities, checks, and .pbd-config.yml customization

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the PbD normative documents, operational guides, and supplementary material.
- 00-principle-index.md — index of all principle identifiers, categories, source mappings, and cross-references.
- 01 through 07 — one document per PbD Foundation Principle with checklist, controls, anti-patterns, and regulatory mappings.
- assessment-protocol.md — phased assessment protocol for agents conducting PbD reviews.
- finding-schema.md — YAML-based finding and summary schema for structured output.
- implementation-patterns.md — code-level and configuration-level patterns agents can verify.
- data-retention-and-disposal.md — Principle 05 deep-dive: retention schedules, disposal methods, legal holds.
- cross-jurisdictional-mapping.md — regulatory equivalence matrix across GDPR, CCPA/CPRA, and APP.
- industry-privacy-profiles.md — telco, healthcare, financial sector profiles with .pbd-config.yml customization schema.

Citation-field vocabulary

Use these fields when capturing a finding so the reviewer can assert a stable source-control reference:

pbd_principle: Principle number (1–7) with short name, e.g., PbD-01 Proactive Not Reactive
gdpr_article: GDPR article reference, e.g., Art. 25
app_principle: Australian Privacy Principle number, e.g., APP 1
ccpa_section: CCPA/CPRA section reference

Finding severity conventions

Severity	Meaning
CRITICAL	Established deficiency with severe direct risk, or FAIL under an effective CRITICAL industry priority
HIGH	Principle is violated with direct risk to data subjects
MEDIUM	Principle is partially met; gaps exist that could lead to non-compliance
LOW	Minor gap; principle intent is largely met but documentation or controls could improve
N/A	No deficiency established, including PASS and unknown-only results

Data sensitivity informs the impact of a proven deficiency; it does not create one. Preserve CRITICAL in records and summaries. CRITICAL and HIGH map to P1, with CRITICAL ordered first; MEDIUM maps to P2 and LOW to P3. PASS and unknown-only results do not create remediation backlog items.

Finding verdict conventions

Verdict	Meaning
PASS	All applicable checks are MET, with no unresolved evidence or anti-patterns
PARTIAL	A deficiency is established but the FAIL threshold is not met
FAIL	More than half of applicable checks are NOT MET, or an uncompensated critical anti-pattern is established
INSUFFICIENT_EVIDENCE	No deficiency established, but unknown evidence or zero applicable checks prevents PASS

Apply the ordered rules in the assessment protocol. Record evidence completeness independently so a proven deficiency is not hidden by unknown checks. Suppressions require a documented applicability reason and do not count as MET.

Overall assessment verdicts

Verdict	Condition
NON_COMPLIANT	One or more principles are FAIL; retain any evidence gaps separately
INCOMPLETE	No FAIL, but any principle or applicable retention/jurisdiction check has incomplete evidence
PARTIALLY_COMPLIANT	Complete evidence, no FAIL, and at least one PARTIAL
COMPLIANT	Complete evidence and all 7 principles PASS

Evaluate these rows in order. Never use null for a verdict or interpret an unknown jurisdictional baseline as met or failed.

Integration with Privacy Planner and Reviewer

This skill complements privacy-standards (which provides the NIST PF, GDPR, CCPA, OWASP backbone). A consumer performing PbD assessment should explicitly load both:

privacy-standards — standards mapping, data-flow reasoning, DPIA thresholds
privacy-by-design — principle-level assessment, retention/disposal checks, cross-jurisdictional equivalence, implementation pattern verification

The current Privacy Planner and Privacy Reviewer do not explicitly load privacy-by-design. This skill supplies assessment knowledge, not automatic integration; dedicated agent wiring is outside this skill change. It remains background-only (user-invocable: false).

Interaction with other skills

Skill	Relationship
`privacy-standards`	Provides data inventory, DPIA thresholds, and standards backbone; PbD builds on top
`security-planning`	Security controls overlap with PbD-05; reference rather than duplicate
`rai-planner`	RAI data-use concerns feed into PbD-04 (full functionality) and PbD-07 (user respect)
`secure-by-design`	SBD-11 (Secure Deprecation) aligns with PbD-05 lifecycle; cross-reference for decommissioning

Attribution and licensing posture

SKILL.md and references/ contain original assessment guidance and paraphrased summaries under CC BY 4.0. The cited publications remain authoritative and retain their own rights; this license does not relicense upstream text. Principle names and legal identifiers are preserved for traceability. No upstream document is reproduced or bundled.

Cavoukian PbD Foundation Principles

Author: Dr. Ann Cavoukian, Information and Privacy Commissioner of Ontario
Source: https://www.ipc.on.ca/sites/default/files/legacy/2018/01/pbd.pdf
Modifications: Principles restructured into agent-consumable assessment checklists with cross-references to GDPR, CCPA, and APP; original principle text paraphrased with attribution
Note: The 7 Foundation Principles are widely referenced in academic and regulatory literature; content here is paraphrased for planning use

Source: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Modifications: Mapped to PbD principles as regulatory equivalence; paraphrased with attribution

Australian Privacy Principles (APP)

Source: https://www.oaic.gov.au/privacy/australian-privacy-principles
Copyright: © Commonwealth of Australia
Modifications: Mapped to PbD principles as cross-jurisdictional equivalence; paraphrased with attribution

CCPA/CPRA

Source: https://oag.ca.gov/privacy/ccpa
Modifications: Mapped to PbD principles as cross-jurisdictional equivalence; paraphrased with attribution

Files

ATTRIBUTION.mdAdded by AutoGineer977 B
LICENSEAdded by AutoGineer16.6 KiB
SKILL.md12.9 KiB
references/00-principle-index.md4.0 KiB
references/01-proactive-not-reactive.md4.4 KiB
references/02-privacy-as-the-default.md4.5 KiB
references/03-privacy-embedded-into-design.md4.7 KiB
references/04-full-functionality.md4.4 KiB
references/05-end-to-end-security.md5.8 KiB
references/06-visibility-and-transparency.md5.6 KiB
references/07-respect-for-user-privacy.md5.5 KiB
references/assessment-protocol.md9.7 KiB
references/cross-jurisdictional-mapping.md13.3 KiB
references/data-retention-and-disposal.md7.1 KiB
references/finding-schema.md10.8 KiB
references/implementation-patterns.md10.1 KiB
references/industry-privacy-profiles.md11.3 KiB

references/cross-jurisdictional-mapping.md

title: Cross-Jurisdictional Mapping description: Regulatory equivalence matrix mapping PbD principles across GDPR, CCPA/CPRA, and Australian Privacy Principles

Cross-Jurisdictional Mapping

This reference provides a regulatory equivalence matrix to help the Privacy Planner and Reviewer identify applicable obligations when a system operates across multiple jurisdictions.

Jurisdictional scope triggers

Assess which regulations apply based on:

Trigger	GDPR	CCPA/CPRA	APP (Australia)
Entity established in jurisdiction	Yes (Art. 3(1))	Yes (Cal. entity)	Yes (Australian entity)
Processing data of jurisdiction's residents	Assess targeting/monitoring (Art. 3(2))	Assess statutory business scope	Assess Australian link (Privacy Act 1988, s 5B)
Revenue threshold	N/A	Statutory threshold, CPI-adjusted every two years (CPPA)	$3M+ annual turnover (or other triggers)
Data volume threshold	N/A	100K+ consumers/households	N/A
Derives revenue from selling data	N/A	50%+ revenue from selling	N/A

PbD principle-to-regulation equivalence matrix

PbD-01: Proactive Not Reactive

Obligation	GDPR	CCPA/CPRA	APP
Privacy assessment before processing	Art. 25(1), Art. 35 (DPIA)	No explicit DPIA but CPRA §1798.185(a)(15) audit regulations	APP 1.2 (reasonable steps)
Risk-based approach	Art. 24 (appropriate measures considering risk)	§1798.100(e) (reasonable security)	APP 11.1 (reasonable steps)

PbD-02: Privacy as the Default

Obligation	GDPR	CCPA/CPRA	APP
Data minimization by default	Art. 5(1)(c), Art. 25(2)	§1798.100(c) (necessary and proportionate processing)	APP 3 (necessary for functions)
Consent and choice	Art. 6–7 (lawful bases and consent conditions)	Sale/sharing opt-out (§1798.120); sensitive-use limitation (§1798.121), not blanket opt-in	APP 3.3 (sensitive collection consent, subject to APP 3.4 exceptions)
Purpose limitation	Art. 5(1)(b)	§1798.100(c) (compatible purposes)	APP 6 (primary purpose or related secondary)

PbD-03: Privacy Embedded into Design

Obligation	GDPR	CCPA/CPRA	APP
Technical measures	Art. 25(1) (pseudonymization, etc.)	§1798.100(e) (reasonable security)	APP 11.1 (reasonable steps)
Organizational measures	Art. 24, Art. 25(1)	Implied (reasonable security)	APP 1.2 (practices, procedures, systems)

PbD-04: Full Functionality

Obligation	GDPR	CCPA/CPRA	APP
Non-discrimination for exercising rights	Art. 7(4) (consent not conditional)	§1798.125 (no discrimination)	Implied (APP 3 — fair means)
Service equivalence	Art. 7(4)	§1798.125(a) (no denial, different price, quality)	Not explicit but fair dealing implied

PbD-05: End-to-End Security

Obligation	GDPR	CCPA/CPRA	APP
Retention limitation	Art. 5(1)(e)	§1798.100(a)(3) (disclose period or criteria)	APP 11.2 (destroy/de-identify, subject to statutory exceptions)
Right to deletion	Art. 17	§1798.105	APP 11.2 (entity-initiated), APP 13.1 (correction on request)
Security of processing	Art. 32	§1798.100(e) (reasonable security)	APP 11.1 (protect from misuse)
Processor obligations	Art. 28 (DPA required)	§1798.100(d) (third-party, service provider and contractor agreements)	APP 8 (cross-border disclosure)

PbD-06: Visibility and Transparency

Obligation	GDPR	CCPA/CPRA	APP
Privacy notice	Art. 12–14	§1798.100(a), §1798.130	APP 1.3–1.6 (privacy policy), APP 5 (collection notice)
Right to access	Art. 15	§1798.100, §1798.110	APP 12
Records of processing	Art. 30	Not explicit but audit requirement emerging	Not explicit but APP 1.2 implies
Third-party disclosure	Art. 13(1)(e)–(f)	§1798.115 (right to know about sharing)	APP 1.4(f)–(g) (overseas recipients and countries in policy)

PbD-07: Respect for User Privacy

Obligation	GDPR	CCPA/CPRA	APP
Consent withdrawal	Art. 7(3) (as easy as giving)	§1798.120 (opt-out of sale)	APP 7 (can withdraw consent for direct marketing)
Data portability	Art. 20	Not in CCPA; CPRA §1798.130(a)(2) (machine-readable)	Not explicit
Correction	Art. 16	§1798.106	APP 13
Objection to processing	Art. 21	§1798.120 (opt-out of sale/sharing)	Not explicit (but APP 7 for direct marketing)
Automated decision-making	Art. 22 (safeguards for covered decisions)	§1798.185 (rulemaking; verify applicable regulations)	Not explicit
Sensitive-information use	Art. 9 (special-category processing conditions)	§1798.121 (right to limit use and disclosure)	APP 3.3, APP 6 (collection and use restrictions)

Key jurisdictional differences

Aspect	GDPR	CCPA/CPRA	APP
Consent model	Consent is one lawful basis (Art. 6–7)	Sale/sharing opt-out; sensitive-use limits (§1798.121)	Sensitive collection consent (APP 3.3), with exceptions
Enforcement body	DPAs (each EU member state)	California AG + CPPA	OAIC
Breach notification	Generally within 72 hours to DPA when required (Art. 33)	Resident notice within 30 calendar days of discovery/notification, subject to permitted delays (§1798.82(a)(2), (c))	Notifiable Data Breaches scheme (30 days assessment)
Cross-border transfer	Adequacy + SCCs/BCRs (Ch. V)	No explicit restriction	APP 8 (reasonable steps for overseas recipients)
Children's data	Art. 8 (parental consent under 16/13)	CalOPPA + COPPA apply	Capacity assessed case by case (OAIC Chapter B)
Maximum fine	€20M or 4% global turnover	$7,500 per intentional violation	A$50M or 30% of turnover (since 2022)

Multi-jurisdictional compliance strategy

When a system spans multiple jurisdictions:

Apply the highest common standard across all applicable regulations as the baseline.
Implement jurisdiction-specific controls only where a regulation imposes unique obligations (e.g., GDPR cross-border transfer mechanisms).
Document which regulations apply and which specific articles govern each data flow.
Maintain a jurisdictional applicability register updated when new markets or data residency requirements emerge.
Identify the applicable lawful basis and consent or choice obligations for each purpose; a privacy-protective default does not mean every regime requires consent for all processing.

The California notice timing above reflects SB 446, effective January 1, 2026. Permitted delays address law-enforcement needs or work necessary to establish breach scope and restore system integrity. Section 1798.82 is a separate breach-notice duty, not a CCPA subsection. APP 2 concerns anonymity and pseudonymity, not extraterritorial scope.

Content synthesized from GDPR (Regulation (EU) 2016/679), CCPA/CPRA (California Civil Code §1798), and Australian Privacy Act 1988 (Privacy Principles). Paraphrased with attribution for planning use, not legal interpretation.

Official sources:

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Microsoft

Publisher

Microsoft (Official)

Source

microsoft/hve-core · .github/skills/project-planning/privacy-by-design · commit f425e94

Licence

Creative Commons Attribution 4.0 International (redistribution allowed)

LICENSE (written by AutoGineer)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download privacy-by-design.zip