lgpd-skills

Apply anonymization (Art. 5, XI) and pseudonymization (Art. 13, §4) techniques to take data out of LGPD scope or reduce risk in analytics pipelines. Use when user asks 'anonimizar', 'pseudonimizar', 'k-anonymity', 'differential privacy', 'tokenização', 'analytics LGPD', or designing analytics/ML pipelines.

Design and implement immutable, hash-chained audit logging for accountability (LGPD Art. 6, X) and incident registration (Res. 15/2024 Art. 10, 5-year retention). Use when user asks 'audit log', 'log de auditoria', 'logging LGPD', 'accountability log', or as part of audit pipeline. Outputs schema + middleware patterns for Next.js.

Maestro orchestrator for end-to-end LGPD (Lei 13.709/2018) compliance in a software project. Use for "como estamos de LGPD", "audite LGPD", "nos deixe LGPD seguros", "gap analysis LGPD", "compliance LGPD", "auditar privacidade", "LGPD do projeto", or any request to assess, implement, or retrofit privacy compliance — including English phrasings like "are we privacy-safe", "audit our privacy", or "we collect personal data, what do we need". Chains specialized sub-skills (data mapping, legal basis, consent, DSAR, incident response, ROPA, RIPD, retention, vendor audit, DPA, international transfer, encarregado, and ECA Digital / Lei 15.211/2025 for platforms with minors) and produces versioned artifacts under .lgpd/. Trigger even when the word "LGPD" is not used.

Design the database schema for a versioned, append-only consent ledger that satisfies LGPD Art. 8 (free, informed, unambiguous consent for a specific purpose) and Art. 9 (information rights). Use when user asks for "consent schema", "consent ledger", "schema de consentimento", "Prisma consentimento", "consent management", or is integrating consent capture with Better Auth, NextAuth, Clerk, or any auth library. Outputs a Prisma schema + integration spec. Also produces the structure needed to support DSAR revocation (Art. 18, IX).

Build and maintain a data inventory (mapa de dados) of all personal data processing activities in the project. Use when user asks "mapa de dados", "data mapping LGPD", "que dados pessoais coletamos", "inventário de tratamento", or as part of an LGPD audit pipeline. Produces `.lgpd/data-map.md`. Especially important for legacy systems where the inventory is built reverse-engineered from code (Prisma schemas, API endpoints, third-party SDKs, log statements).

Draft and review Data Processing Agreements (DPA) with operadores under LGPD Art. 39. Use when user mentions 'DPA', 'contrato com operador', 'cláusulas LGPD', 'data processing agreement', or onboarding a new third-party service (analytics, cloud, payment, email, SMS, observability). Outputs DPA template + per-vendor sheets in `.lgpd/vendors/`.

Designate and publish the Encarregado (DPO) per LGPD Art. 41 + Resolução CD/ANPD nº 18/2024. Use when user asks 'designar DPO', 'encarregado LGPD', 'quem é o DPO', or as part of audit pipeline. Note ATPP exemption (Res. 2/2022 Art. 11) but recommend designation anyway as best practice.

Implement endpoints and workflow for data subject access requests (direitos do titular) under LGPD Art. 18. Use when user asks for "DSAR", "direitos do titular", "exportar dados do usuário", "portabilidade LGPD", "exclusão de conta LGPD", "right to be forgotten", or as part of audit pipeline. Covers all 9 rights (confirmação, acesso, correção, anonimização, portabilidade, eliminação, info compartilhamento, info não-consentir, revogação). The 15-day deadline (Art. 19, II) is non-negotiable — encoded in this skill. Outputs `.lgpd/dsar/workflow.md` + endpoint specs.

Implement obligations under Lei nº 15.211/2025 (ECA Digital), in force since 17 March 2026, for platforms accessed by minors or 'likely to be accessed' by them. Use when user mentions 'ECA Digital', 'menores', 'crianças e adolescentes', 'verificação de idade', 'controle parental', or when the project may have users under 18 (Discord, gaming, social media, education, content streaming). Covers age verification, parental linking, profiling ban, loot box ban, transparency reports.

Configure encryption at rest, in transit, and key management aligned with LGPD Art. 46 (security duty) and the ANPD's Guia de Segurança da Informação para ATPP. Use when user asks 'criptografia LGPD', 'KMS', 'TDE', 'encryption at rest', 'rotação de chaves', 'pgcrypto', 'column-level encryption'. Tailored for Prisma/PostgreSQL/Better Auth stack.

Execute the LGPD security incident response runbook (Art. 48 LGPD + Resolução CD/ANPD nº 15/2024). Use when user says "tivemos um incidente", "vazamento de dados", "data breach", "preciso comunicar a ANPD", "incident response LGPD", or as part of an audit pipeline preparing the runbook in advance. Encodes the 3-business-day deadline to notify ANPD and data subjects, the 12 mandatory items for ANPD notification, the 7 items for subject notification, and the 5-year retention requirement for ALL incident records (notified or not). Cite Resolution 15/2024 explicitly in outputs.

Set up international data transfers per LGPD Arts. 33-36 and Resolução CD/ANPD nº 19/2024 (Cláusulas-Padrão Contratuais brasileiras). Use when user asks 'transferência internacional', 'AWS US LGPD', 'cláusulas-padrão', 'SCCs Brasil', 'data residency', or onboarding any operator outside Brazil. Outputs per-vendor transfer assessment in `.lgpd/transfers/`.

Run a gap analysis and retrofit plan for an existing system that wasn't built with LGPD in mind. Use when user asks 'auditar projeto legado LGPD', 'gap analysis LGPD', 'sistema antigo LGPD', 'temos LGPD?', 'estamos em compliance?', or when invoking lgpd-audit on a legacy codebase. Produces prioritized remediation plan in `.lgpd/gaps.md`. Entry point for Pipeline B.

Choose and document the lawful basis (base legal) for each personal data processing activity under LGPD Art. 7 (common data) or Art. 11 (sensitive data). Use when the user is designing a new feature that processes personal data, reviewing an existing activity, asking "qual base legal usar", "consentimento ou legítimo interesse", "podemos coletar isso", or running an LGPD audit step. Produces `.lgpd/legal-basis.md` with one entry per activity. Always cite the article. Use whenever someone is about to write code that touches personal data.

Draft, version, and publish a privacy policy compliant with LGPD Art. 9 (seven mandatory elements) and ECA Digital if minors are present. Use when user asks "política de privacidade", "privacy policy", "termos de uso", "aviso de privacidade", or as part of an audit pipeline. Versions every published change. Output goes to `.lgpd/policies/privacy-policy-v{N}.md`. CHECKPOINT skill — never publish without legal review.

Define retention rules and erasure mechanisms (LGPD Arts. 15-16) reconciling subject's right to erasure (Art. 18, VI) with legal retention obligations (fiscal, labor, banking). Use when user asks 'retenção LGPD', 'quanto tempo guardar', 'eliminação de dados', 'soft delete vs hard delete', 'crypto-shredding', 'right to be forgotten'.

Produce a Relatório de Impacto à Proteção de Dados (RIPD / DPIA) under LGPD Art. 38 for high-risk processing activities. Use when user asks "RIPD", "DPIA", "relatório de impacto", "avaliação de impacto LGPD", or when lgpd-data-mapping flagged an activity as high-risk under Resolução ANPD nº 2/2022 Art. 4 (large scale, profiling, sensitive data, minors/elderly, emerging tech, public surveillance, automated decisions). Produces `.lgpd/RIPD/ripd-{slug}.md`. Always cite the assessment methodology.

Generate and maintain the Registro de Operações de Tratamento de Dados Pessoais (ROPA) required by LGPD Art. 37. Use when user asks for "ROPA", "registro de operações", "registro de tratamento", or as part of the lgpd-audit pipeline. Consolidates input from `lgpd-data-mapping` and `lgpd-legal-basis` into the official ANPD template structure. Especially relevant when preparing for ANPD inspection or onboarding a new vendor that requests the ROPA.

Conduct due diligence on third-party operators (operadores) under LGPD Art. 39. Use when user asks 'auditar fornecedor', 'vendor audit LGPD', 'operadores LGPD', 'devida diligência', or onboarding/reviewing third-party services. Produces vendor tier assessment + remediation list.