Privacy Engineering
Implement technical privacy controls that make declared data-use, minimization, retention, consent, subject-rights, and deletion requirements enforceable and auditable in real systems.
A focused method your agent applies to a specific problem or piece of work.
Ask your connected agent for an outcome. It finds relevant methods and business context.
- What you get
- What to bring
- declared privacy requirements and approved legal/policy interpretations
- business purposes for collecting and using personal data
- data stores, services, analytics systems, logs, queues, caches, search indexes, backups, and third parties
- data classifications and sensitivity requirements
- retention and deletion requirements
- consent or preference requirements
- access/export/deletion request requirements
- security, identity, audit, and incident-response constraints
- data residency, transfer, or processing-boundary requirements when applicable
How it works 3 steps
A typical way this skill turns context into a useful result. The exact choices depend on your task.
- 01
Frame the task Input Your goal and relevant context→Output A focused starting point
- 02
Apply the skill Input The focused starting point→Output A draft or recommendation
- 03
Review and refine Input The draft or recommendation→Output A result ready to use
↶ Review, learn, and revisit an earlier step when needed.
Decision rules
- Privacy engineering implements approved privacy requirements; it does not invent legal basis, jurisdictional obligations, or policy interpretation. - Do not claim that data is anonymous merely because obvious identifiers were removed. - Do not keep personal data “just in case” when no approved business purpose requires it. - Consent/preferences must be enforced at the point where data is collected, used, or shared when the approved requirement depends on them. - Deletion is a distributed-systems problem when copies exist outside the primary store. - Some records may be subject to retention exceptions or holds; keep those exceptions explicit and traceable rather than pretending deletion is universal. - Backups may require tombstoning, delayed expiry, or controlled restore behavior rather than immediate physical deletion; follow approved requirements and platform constraints. - Pseudonymized data can remain personal data if re-linking is possible; do not treat pseudonymization as equivalent to anonymization. - Encryption protects confidentiality but does not by itself satisfy minimization, purpose limitation, retention, or deletion requirements. - Third-party sharing needs explicit ownership, contract/policy alignment, deletion/export behavior, and current integration evidence. - Prefer data-flow simplification over adding privacy controls to unnecessary copies.
Guardrails
- Privacy engineering implements approved privacy requirements; it does not invent legal basis, jurisdictional obligations, or policy interpretation. - Do not claim that data is anonymous merely because obvious identifiers were removed. - Do not keep personal data “just in case” when no approved business purpose requires it. - Consent/preferences must be enforced at the point where data is collected, used, or shared when the approved requirement depends on them. - Deletion is a distributed-systems problem when copies exist outside the primary store. - Some records may be subject to retention exceptions or holds; keep those exceptions explicit and traceable rather than pretending deletion is universal. - Backups may require tombstoning, delayed expiry, or controlled restore behavior rather than immediate physical deletion; follow approved requirements and platform constraints. - Pseudonymized data can remain personal data if re-linking is possible; do not treat pseudonymization as equivalent to anonymization. - Encryption protects confidentiality but does not by itself satisfy minimization, purpose limitation, retention, or deletion requirements. - Third-party sharing needs explicit ownership, contract/policy alignment, deletion/export behavior, and current integration evidence. - Prefer data-flow simplification over adding privacy controls to unnecessary copies.
Example outcome request
Describe the result you need and add your team's context. Your connected agent finds the methods that fit.
I want this outcome: Implement technical privacy controls that make declared data-use, minimization, retention, consent, subject-rights, and deletion requirements enforceable and auditable in real systems.
Use my team's shared skills, workflows, and business context through Popasoda to find the relevant methods. Consider Privacy Engineering (privacy-engineering) if it fits the goal. Ask for missing context before starting, and follow the chosen methods' review gates and guardrails.
Relevant guardrails for this method: - Privacy engineering implements approved privacy requirements; it does not invent legal basis, jurisdictional obligations, or policy interpretation. - Do not claim that data is anonymous merely because obvious identifiers were removed. - Do not keep personal data “just in case” when no approved business purpose requires it. - Consent/preferences must be enforced at the point where data is collected, used, or shared when the approved requirement depends on them. - Deletion is a distributed-systems problem when copies exist outside the primary store. - Some records may be subject to retention exceptions or holds; keep those exceptions explicit and traceable rather than pretending deletion is universal. - Backups may require tombstoning, delayed expiry, or controlled restore behavior rather than immediate physical deletion; follow approved requirements and platform constraints. - Pseudonymized data can remain personal data if re-linking is possible; do not treat pseudonymization as equivalent to anonymization. - Encryption protects confidentiality but does not by itself satisfy minimization, purpose limitation, retention, or deletion requirements. - Third-party sharing needs explicit ownership, contract/policy alignment, deletion/export behavior, and current integration evidence. - Prefer data-flow simplification over adding privacy controls to unnecessary copies.