# EU privacy notice drafter
> Source: https://legalcode.md/skills/legalcode-eu-privacy-notice-drafter | [HTML version](https://legalcode.md/skills/legalcode-eu-privacy-notice-drafter)

Draft and review GDPR-compliant privacy notices for any EU/EEA audience or jurisdiction.

Draft and review GDPR-compliant privacy notices for any EU/EEA audience or jurisdiction. Use when a user asks to create a privacy policy, privacy notice, Datenschutzerklärung, politique de confidentialité, or any Art. 13/14 transparency disclosure. Covers five notice types: Website/App, Applicant/Recruiting, Employee, Business Partner (B2B), and B2C Customer. Deep GDPR coverage: controller identity, all six Art. 6 lawful bases, Art. 9 special categories, retention periods, international transfers (SCCs, DPF, BCRs, adequacy), Art. 15–22 data subject rights, Art. 21 right-to-object prominence requirements, Art. 22 automated decision-making, cookie and tracking disclosures, AI Act (Regulation 2024/1689) transparency obligations, DPIA indicators, DPO, joint controllership (Art. 26), and member-state localization for all 27 EU Member States plus EEA. Also triggers when reviewing an existing privacy notice for GDPR compliance gaps, missing mandatory disclosures, or update requirements after regulatory changes. Native EU replacement for imported privacy-notice packs.

This skill drafts GDPR-compliant privacy notices for any EU/EEA controller, and reviews existing notices for compliance gaps. It supports both **creation** (drafting from scratch) and **review** (auditing an existing notice against Art. 13/14 mandatory disclosures and member-state requirements). **Covers:** - Five notice types: Website/App · Applicant/Recruiting · Employee · Business Partner (B2B) · B2C Customer - All Art. 13/14 mandatory disclosures with COMPLIANT / PARTIAL / NON-COMPLIANT gap scoring - All six Art. 6(1) lawful bases with member-state nuances - Art. 9 special categories with dual-basis protocol - Art. 22 automated decision-making and EU AI Act (Reg. 2024/1689) interplay - International transfers: adequacy decisions, SCCs (2021), DPF, BCRs, Art. 49 derogations - Member-state localization markers for all 27 EU Member States + Norway, Iceland, Liechtenstein - Retention matrix generation with jurisdiction-specific legal citations - Cookie and tracking transparency linked to ePrivacy national implementing laws - DPA/Art. 28 gap identification (processor DPAs required alongside the notice) - Joint controllership (Art. 26) and Art. 14 indirect-collection disclosure triggers - DPIA indicator assessment (Art. 35) as a drafting gate **Does not:** - Draft Data Processing Agreements (Art. 28) — see `legalcode-dpa-review-and-negotiation` - Conduct Data Protection Impact Assessments — see `legalcode-dpia-generator` - Cover UK ...

## Jurisdictions

European Union



---
*Legalcode -- legalcode.md*