Legitimate Interest

What this skill does

Conducts a structured Legitimate Interest Assessment (LIA) under Art. 6(1)(f) GDPR using the full EDPB three-step test — interest identification, strict necessity analysis, and the balancing test with mitigation. Built on EDPB Guidelines 1/2024, Opinion 28/2024 (AI models), CNIL guidance (June 2025), ICO/DUA Act 2025, key CJEU judgments, and DPA positions from DE/FR/NL/AT/IT/ES/UK. Includes specialised modules for AI/ML, marketing, fraud prevention, children's data, employee monitoring, ePrivacy overlap, and cross-border, plus a dedicated Right to Object (Art. 21) response mode and structured LIA output. Use this skill whenever the user mentions GDPR Art. 6(1)(f), legitimate interest, the LIA or three-step test, EDPB/DPA guidance, AI training data lawfulness, web scraping legality, direct marketing or fraud prevention legal basis, employee monitoring, the right to object, or asks for a balancing test — even if they don't say "LIA" explicitly.

• Legitimate
• Interest

Where it runs, and how to install it

Agent Skills are a format, not a product feature: a folder with a SKILL.md and whatever files it needs. Nothing inside one is model-specific.

Claude

Drop the skill folder into ~/.claude/skills/, or upload it in Settings → Capabilities. Claude loads it when the description matches what you asked for.

Claude Code

Same folder, per-project instead: .claude/skills/ inside the repository, so the skill travels with the work rather than with the machine.

Any agent that reads SKILL.md

A skill is a folder with a SKILL.md and whatever files it needs. Nothing in the format is model-specific, so a runtime that reads the file reads the skill.

More from Oliver Schmidt-Prietz

• DPIA SentinelGDPR Data Protection Impact Assessment (DPIA) guidance under Article 35 GDPR, EDPB Guidelines WP 248 rev.01, EDPB Opinion 28/2024 (AI), and national SA blacklists/whitelists. Covers threshold assessment, multi-jurisdictional blacklist checks (DE, FR, IE, BE, NL, IT, PL), 5x5 risk scoring, necessity/proportionality analysis, mitigation mapping, Art. 36 prior consultation, AI dual-phase analysis, an
• GDPR Breach SentinelIncident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Covers breach risk assessment using ENISA severity methodology, Controller vs Processor obligations, 72-hour notification clock management, EDPB case matching, cross-border Lead SA determination, AI Act Art. 62 intersection, mitigation playbooks, and audit-ready .docx document generation.
• Data Processing Agreement Art. 28 GDPRReview, draft, or redline a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag / AVV) under Art. 28 GDPR, or prepare a Joint Controller Arrangement under Art. 26 GDPR (basic). Supports bilingual output (DE/EN), both controller- and processor-side perspectives, and two review depths — quick (Art. 28(3)(a)–(h) coverage) and negotiation-grade (clause-by-clause risk scoring).
• EU AI Act System ClassifierDetermine whether a technology qualifies as an AI system under Art. 3(1) and classify its risk tier (prohibited, high-risk, GPAI with systemic risk, limited risk, minimal risk). Covers scope exclusions (Art. 2), AI system definition test (7 criteria), prohibited practice screening (Art. 5), high-risk assessment (Annex I + III with Art. 6(3) exception), GPAI check, and Art. 50 transparency triggers.
• EU AI Act High-Risk ClassifierDepth assessment of whether an AI system is high-risk under Art. 6 of the EU AI Act, grounded in the Commission's draft Art. 6(5) classification guidelines (general principles + Annex I + Annex III). Covers the Annex I product-safety route, all eight Annex III areas with worked examples, the Art. 6(3) exception and its profiling re-exception, and the Art. 25 quasi-provider trap. Outputs a structured decision block, a practitioner memo, and a JSON interchange artefact.
• EU AI Act Knowledge BaseAuthoritative regulatory Q&A grounded in 70 official EU source documents, including the 2026 Commission draft guidelines on Art. 6 high-risk classification. Answers any EU AI Act question with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, and sector-specific guidance — covering penalties, timelines, GPAI obligations, high-risk and prohibited practices, and the AI Act / GDPR interplay.

Skills that do related work

• Agent Authority Charter BuilderCreates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allow
• Agentic Delegation AuditUse when a lawyer, legal team, or client needs to assess AI agents that can act on someone's behalf: send messages, search, draft, file, pay, delete, connect to
• AI Audit TrailThis skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output
• AI Governance ReviewerConduct AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk reviews of internal AI use cases, AI product features, LLM workflows, or thi
• Ai InventoryEU AI Act per-system inventory — track each AI system's role (provider, deployer, importer, distributor, authorized representative, product manufacturer) and ri
• Aia GenerationRun an AI impact assessment — structured intake, risk analysis, regulatory classification per regime in scope, policy consistency diff, and recommendation with