pm-privacy-requirementslisted

# PM - Privacy Requirements ## Agent mode (`--agent`) Supports `--agent`: runs autonomously in a subagent, drafts the artifact from existing inputs, and returns a short summary + coverage note. - **No flag** → interactive (default); if inputs are heavy, offer agent mode. - **`--agent`** → obey. First check inputs are complete. Anything missing: do NOT invent it - mark `[ASSUMED - what/why]` in the output and summary. Never hallucinate to fill a gap. --- ## What this skill does Maps the domain model to privacy and data protection obligations. Produces: 1. PII Inventory - which entities contain personal data, what type, and how sensitive 2. Privacy Requirements - what the system must do to comply (consent, retention, rights) 3. GDPR Action Plan - concrete actions with owners and timing before launch This skill runs after `pm-domain-model` - entities must be defined to inventory PII accurately. Output feeds directly into Phase 6 (`pm-feature-design` references privacy rules in Feature Card Section 1 for features that handle personal data). This is a PM-level analysis, not a legal opinion. Validate with legal counsel before launch. --- ## Dependencies **Required before running:** - `pm-domain-model` - entities and their attributes are the input for PII mapping **Recommended before running:** - `pm-domain-analysis` - legal requirements from Phase 2 provide the regulatory baseline **Produces artifacts used by:** - `pm-business-rules-library` - privacy rules become RUL