Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

privacy-eu — EU GDPR 전용 스킬 · kimlawtech | DecimalAI

kimlawtech/privacy-eu

SkillScore86Maintained

EU 사용자 대상 서비스용 Privacy Notice·Terms of Service·Consent Modal·Cookie Banner 자동 생성. GDPR (Regulation 2016/679) + ePrivacy Directive + Consumer Rights Directive 2011/83 + Digital Services Act + Digital Content Directive + Unfair Terms Directive 반영. 영문 인터뷰로 진행.

legalby kimlawtech

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Legal & Contracts pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/kimlawtech-privacy-eu/SKILL.md

decimalai skills pull kimlawtech-privacy-eu --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/kimlawtech-privacy-eu/SKILL.md https://app.decimal.ai/s/kimlawtech-privacy-eu/SKILL.md

Raw file: /s/kimlawtech-privacy-eu/SKILL.md ↗ · machine-readable summary at /s/kimlawtech-privacy-eu.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 35d ago

Yes — +14% lift · at higher cost+41% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	44%	0%
case-05	✗→✓	▲ Improved	-29%	0%
case-09	✗→✓	▲ Improved	22%	0%
case-01	✓→✓	＝ Same ✓	114%	0%
case-03	✓→✓	＝ Same ✓	244%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

kimlawtech / korean-privacy-terms

skills/privacy-eu/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/3/2026Version v1

Skill contents

SKILL.md

privacy-eu — EU GDPR 전용 스킬

호출 즉시 출력 (영문 인터뷰 시작 안내)

Starting EU GDPR Privacy Notice & Terms generator.

인터뷰는 영문·GDPR 용어로 진행합니다. (사용자 답은 한국어로 하셔도 됩니다)
법령: GDPR Art. 13-14, Art. 6, Art. 9, Chapter V, DSA, CRD 14-day withdrawal

몇 가지만 여쭤볼게요.

법령 근거 (MUST READ)

./jurisdictions/eu-gdpr/gdpr-checklist.md — GDPR Art. 13-14 공개 21종·8대 권리·Art. 6 근거·Art. 83 과태료
./jurisdictions/eu-gdpr/terms-checklist.md — CRD·DSA·DCD·Unfair Terms
./references/glossary.md — 용어 풀이 (DPO·Data Controller·SCCs 등)
./references/design-system-detection.md — UI variant

인터뷰 범위

./scripts/interview.md 중 다음만 수행:

유지

Step 1 서비스 소개 (serviceName·serviceDescription·operatorName·serviceType)
Step 2 수집 항목 (자동 수집·민감·고유식별)
Step 6 처리위탁 (→ Art. 28 Processors + 국제 이전 자동 추론)
Step 9 시행일·개정 여부
Step 9-EU 전부 (Q9E-1~11)
Step 10 디자인 스타일
Step 11 최종 확인

생략 (한국 전용)

Step 3 수집 방법 (EU는 Art. 14 출처 개념으로 Q9E-6에 통합)
Step 4 한국식 처리 목적 (Q9E-4 Legal Basis로 대체)
Step 5 한국식 제3자 제공 (Q9E-8 Recipients로 대체)
Step 7 한국 CPO (Q9E-2 DPO로 대체)
Step 8 한국 특수 상황
14세 미만 → Q9E-11 (16세 기본)
AI 자동화·행태광고·전송요구권·국내대리인은 EU는 다르게 처리

사용 템플릿

./jurisdictions/eu-gdpr/privacy-notice.en.mdx.tmpl → src/app/privacy/page.tsx
./jurisdictions/eu-gdpr/terms-of-service.en.mdx.tmpl → src/app/terms/page.tsx

치환 프로토콜

./scripts/render.md의 EU GDPR 치환 규칙 섹션 필독. 조건부 블록 13종 해석·검증 키워드 지정됨.

UI 컴포넌트 locale

모든 컴포넌트에 locale="en" prop 박기:

tsx
<ConsentModal locale="en" />
<CookieBanner locale="en" variant="center-modal" blocking={true} />
<LabelingCard /* 영문 라벨로 텍스트 대체 */ />

CookieBanner는 GDPR 옵트인 모드:

variant="center-modal" 또는 variant="bottom-bar" + 옵트인 UX
Reject all 버튼을 Accept all과 동등 노출 (CNIL·EDPB)

생성 대상 파일 (src-app 기준)

src/mdx-components.tsx
src/content/legal/privacy-policy.mdx         (GDPR Privacy Notice)
src/content/legal/terms-of-service.mdx       (EU Terms)
src/app/privacy/page.tsx                     (locale="en")
src/app/terms/page.tsx                       (locale="en")
src/components/legal/ConsentModal.tsx
src/components/legal/CookieBanner.tsx
src/components/legal/LabelingCard.tsx

검증 (Write 후 필수)

] Data Controller 정보
] 8대 권리 (Access·Rectification·Erasure·Restriction·Portability·Object·Art. 22·Withdraw)
] Art. 6 Legal basis 명시
] Supervisory authority·EDPB 링크
] 72h breach notification (해당 시)
] DPO·EU Representative (해당 시)
] International transfer·SCCs (해당 시)
] CRD 14-day withdrawal + model form
] DSA Art. 17 Statement of Reasons (platform 시)
] ODR 링크 https://ec.europa.eu/consumers/odr

완료 출력

[Generated]
- src/content/legal/privacy-policy.mdx (GDPR)
- src/content/legal/terms-of-service.mdx (CRD + DSA)
- src/app/privacy/page.tsx, src/app/terms/page.tsx
- src/components/legal/*.tsx (locale="en")

[Checks]
- GDPR Art. 13-14 disclosures complete
- 8 data subject rights covered
- CRD 14-day withdrawal included
- ODR link inserted

[Next steps]
1. Add <CookieBanner locale="en" variant="center-modal" /> to layout
2. Connect <ConsentModal locale="en" /> to signup form
3. Footer links to /privacy and /terms

[Reminder]
Legal review by EU counsel required before production.
GDPR Art. 83 fines: up to €20M or 4% global turnover.

──────────────────────────────────────────

Feedback, bug reports, or legal update suggestions?
Join SpeciAI — a Korean legal AI hub community where lawyers, developers,
and founders discuss privacy, GDPR, and AI-related legal tooling.

→ https://discord.gg/wQWpEpnBfE

Illustrative Want to see what kimlawtech/privacy-eu would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/23/2026, 22:53 UTC · 22 cases

Lift

+14%

86% vs 73%

Agent turns

1.0 vs 1.0

Tokens

+41%

3,494.32 vs 2,470.36

fail → pass · 3pass → pass · 16fail → fail · 3

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 We are expanding our SaaS platform into the European Union and need to generate compliant GDPR privacy notices and terms of service for our web app. Please launch the interactive interview process in English so we can provide our service details and build the necessary legal MDX files and UI components for our Next.js project.	pass→pass	8,693	22,003	+153%	1	1	0%	1,394	2,990	+114%	0	0	—
case-02 I need to set up EU-compliant legal documentation, specifically a GDPR Privacy Policy and European Terms of Service, along with English-localized consent and cookie banner components in src/app. Can you start the EU legal document interview and walk me through the required questions?	fail→pass	13,452	10,486	-22%	1	1	0%	2,193	3,153	+44%	0	0	—
case-03 Our startup is preparing for a launch in Europe and requires privacy notices adhering to GDPR Articles 13-14 and terms covering European consumer protection. Please initiate the GDPR legal notice interview wizard so we can generate the app pages and legal MDX files.	pass→pass	6,330	11,552	+82%	1	1	0%	998	3,429	+244%	0	0	—
case-04 We operate an e-commerce platform exclusively in South Korea targeting domestic customers in Seoul. We need to generate a privacy policy in Korean following the Korean Personal Information Protection Act (PIPA). Please run the standard Korean PIPA privacy policy questionnaire.	fail→fail	16,353	10,339	-37%	1	1	0%	2,577	3,218	+25%	0	0	—
case-05 Our e-commerce service is expanding into California and needs a CCPA/CPRA privacy policy including the 'Do Not Sell or Share My Personal Information' link and notice at collection. Please generate our CCPA compliance files.	fail→pass	26,447	9,997	-62%	1	1	0%	4,312	3,063	-29%	0	0	—
case-06 We are deploying an AI-driven credit scoring tool in France and need a full EU AI Act Risk Management and Conformity Assessment report for high-risk AI systems under Regulation (EU) 2024/1689.	fail→fail	37,497	16,118	-57%	1	1	0%	6,189	4,114	-34%	0	0	—
case-07 When collecting personal data from children across European Union member states for an online service, what is the default age threshold under GDPR Article 8 for requiring parental consent, compared to South Korean law?	pass→pass	7,880	12,225	+55%	1	1	0%	1,368	3,353	+145%	0	0	—
case-08 We need to configure our Next.js CookieBanner UI component for European regulatory compliance under EDPB and CNIL guidance. What presentation variant and button display rules must be enforced?	pass→pass	22,468	13,681	-39%	1	1	0%	3,867	3,530	-9%	0	0	—
case-09 We are generating Next.js page files and components for our European legal documentation section. What language locale prop must be passed to the ConsentModal, CookieBanner, and LabelingCard UI components?	fail→pass	9,508	3,521	-63%	1	1	0%	1,620	1,983	+22%	0	0	—
case-10 How should user data collection grounds be structured for European users under GDPR, rather than relying on traditional Korean-style processing purpose categories?	pass→pass	20,011	17,719	-11%	1	1	0%	3,124	4,255	+36%	0	0	—
case-11 When generating an EU GDPR privacy notice, what specific data subject rights must be disclosed to ensure compliance with Chapter III requirements?	pass→pass	13,654	11,119	-19%	1	1	0%	2,455	3,510	+43%	0	0	—
case-12 In our European privacy documentation, how should data transfers to third-party vendors and processors outside the European Economic Area (EEA) be structured?	pass→pass	16,833	19,978	+19%	1	1	0%	2,695	4,600	+71%	0	0	—
case-13 When evaluating organizational roles for European compliance instead of a South Korean Chief Privacy Officer (CPO), what designated roles should be assessed for EU operations?	pass→pass	15,789	15,330	-3%	1	1	0%	2,417	3,834	+59%	0	0	—
case-14 What mandatory consumer protection disclosures must be included in European terms of service for B2C e-commerce contracts under the Consumer Rights Directive?	fail→fail	16,240	18,188	+12%	1	1	0%	2,720	4,333	+59%	0	0	—
case-15 If our web service functions as an online platform hosting user-generated content in the EU, what specific obligation under Article 17 of the Digital Services Act (DSA) must be reflected in our legal documentation?	pass→pass	11,735	14,041	+20%	1	1	0%	1,866	3,665	+96%	0	0	—
case-16 Where should European consumers be directed for out-of-court dispute resolution in the terms of service, as required by EU consumer protection regulations?	pass→pass	12,919	5,934	-54%	1	1	0%	2,045	2,342	+15%	0	0	—
case-17 Our marketing team wants to set up a cookie banner that pre-activates analytics and tracking cookies upon page load, giving European visitors an opt-out link in the footer to disable them. How should this consent mechanism be implemented for EU users?	pass→pass	13,497	21,989	+63%	1	1	0%	2,118	5,659	+167%	0	0	—
case-18 A customer in Germany submits a GDPR Article 17 erasure request demanding immediate deletion of all their records, including past tax invoices and financial transaction logs. How should an EU-compliant data controller handle this request?	pass→pass	13,568	12,799	-6%	1	1	0%	2,199	3,464	+58%	0	0	—
case-19 During the legal documentation setup for an EU service, how is data collected from third-party sources (indirect collection) handled compared to direct collection?	pass→pass	15,132	13,237	-13%	1	1	0%	2,557	3,582	+40%	0	0	—
case-20 We are drafting European Terms of Service for our B2C SaaS platform hosted in Dublin. Can we include a mandatory forum selection clause designating Irish courts as the exclusive jurisdiction for all consumer legal disputes across all EU member states?	pass→pass	13,881	10,334	-26%	1	1	0%	2,224	3,146	+41%	0	0	—
case-21 In the completion summary of an EU GDPR legal generation process, what maximum administrative penalty details should be highlighted to emphasize statutory risk?	pass→pass	14,043	7,054	-50%	1	1	0%	2,305	2,669	+16%	0	0	—
case-22 What regulatory notification timeframe requirement under GDPR Article 33 must be documented for personal data security incidents?	pass→pass	6,286	9,071	+44%	1	1	0%	1,105	2,983	+170%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +14 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 72.7%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/23/2026, 22:53 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-02

Prompt

I need to set up EU-compliant legal documentation, specifically a GDPR Privacy Policy and European Terms of Service, along with English-localized consent and cookie banner components in src/app. Can you start the EU legal document interview and walk me through the required questions?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+64% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 35 days ago

Other measured skills in the registry, with their headline benchmark lift.