customize

name	customize
description	Guided customization of your privacy practice profile — change one thing without re-running the whole cold-start interview. Adjust risk posture, escalation contacts, DPA playbook, privacy policy commitments, PIA house style, personal information rights request process, or matter workspace paths. Use when the user says "change my [thing]", "update my profile", "edit my playbook", or "customize".
argument-hint	[section name, or describe what you want to change]

/customize

When this runs

The user typed /privacy-legal:customize. They want to change something in their privacy profile — a risk posture, an escalation contact, a DPA position, a PIA section, a personal information rights request timeline — without re-running the whole cold-start interview and without hand-editing YAML.

What to do

1. Read the config. Read ~/.codebuddy/plugins/config/legal-workflows/privacy-legal/practice-profile.md (and ~/.codebuddy/plugins/config/legal-workflows/company-profile.md one level up). If the plugin config does not exist or still contains [PLACEHOLDER] values, say:

   You haven't run setup yet. Run /privacy-legal:cold-start-interview first — customize is for adjusting a profile you already have.

2. Show the customizable map. List what's in the profile, grouped, with a one-line summary of the current value:

   • Company / who you are — name, industry, jurisdictions, stage, practice setting, controller vs. processor orientation (shared across all 12 plugins — changes flow through company-profile.md)
   • Risk posture — conservative / middle / aggressive, what each means for processor obligations, cross-border transfers, and retention
   • People — DPO, privacy team, engineering liaison, outside counsel, escalation chain
   • DPA playbook — positions on sub-processor notice, deletion, audit, liability, international transfers, SCCs — as processor and as controller
   • Privacy policy commitments — the commitments your privacy notice has made that /policy-monitor watches practice against
   • PIA house style — section order, risk scoring, stakeholder framing, when DPIA triggers apply
   • personal information rights request process — verification, statutory timelines per regime, exemption application, template response structure
   • Workflow — intake path, matter workspaces, policy-monitor sweep cadence
   • Integrations — document storage / privacy tool / Slack status, fallbacks

3. Ask what they want to change.

   What would you like to adjust? Pick a section, or describe the change in your own words.

4. Make the change. Show the current value, ask for the new value, explain what changes downstream, confirm, write it to the config.

   Examples:

   • Sub-processor notice 30 days → 14 days: "/review-dpa will now flag anything shorter than 14 days as a deviation. Existing DPAs stay as logged."
   • New personal information rights request exemption in the playbook: "/draft-personal-information-rights-request will surface this exemption in the assessment step where the facts match."
   • Risk posture middle → conservative: "I'll flag more activities for PIA escalation, recommend stricter SCC clauses, and be more conservative on retention."

5. For shared-profile changes (company name, industry, jurisdictions, practice setting, stage): write to ~/.codebuddy/plugins/config/legal-workflows/company-profile.md and note:

   This change affects all 12 plugins — any plugin that reads your jurisdiction footprint now sees [new value].

6. Close.

   Done. Your next output will reflect the change. Anything else? You can run /privacy-legal:customize anytime.

Guardrails

• Never delete a section. If the user wants to "remove" a regime from scope, offer to mark it [Not currently in scope] and explain what flagging drops.
• Flag internal inconsistency. If the change would make the profile inconsistent (e.g., "processor only" + controller playbook positions active; or "no EU nexus" + SCCs in the default template), flag the tension.
• Flag guardrail degradation. The [review] flag, source attribution tags, [verify] tags on cited regulations, and the DPIA-trigger mandatory-check on /triage are load-bearing — do not remove. If statutory personal information rights request timelines are adjusted below the regulatory minimum, refuse and explain why.
• One change at a time. Don't re-ask the whole interview.