Update to Rohas Legal AI: Privacy

{
  "description": "Coordinate legal and operational response to suspected personal-data breaches, including containment, evidence preservation, fact development, role analysis, harm assessment, regulator and individual notification decisions, contractual notices, communications, remediation, and post-incident review.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 347
    }
  ],
  "name": "breach-response-planner",
  "skill_md_contents": "---\nname: breach-response-planner\ndescription: >-\n  Coordinate legal and operational response to suspected personal-data breaches,\n  including containment, evidence preservation, fact development, role analysis,\n  harm assessment, regulator and individual notification decisions, contractual\n  notices, communications, remediation, and post-incident review.\n---\n\n# Breach Response Planner\n\nRun an evidence-led response without delaying containment. Treat notification\ndeadlines as live from the earliest plausible awareness time until counsel confirms otherwise.\n\n## Immediate intake\n\nObtain detection and awareness times, reporter, incident owner, affected systems,\ndata and people, jurisdictions, entities and roles, vendors, attack or error\nvector, access and exfiltration indicators, containment status, encryption and\nkeys, logs, contracts, insurance, law-enforcement contact, prior incidents, and\nregulatory or sector obligations.\n\n## Response method\n\n1. Establish a cross-functional incident team, decision authority, secure\n   communication channel, privilege position, action log, and reporting cadence.\n2. Protect people and systems, contain ongoing exposure, preserve forensic\n   evidence and logs, and avoid destructive remediation before capture.\n3. Build a fact chronology and distinguish confirmed, likely, possible, disputed,\n   and unknown facts. Record when each relevant entity became aware.\n4. Determine whether the event affected confidentiality, integrity, or\n   availability of personal data and whether it meets each applicable legal definition.\n5. Map controller, processor, fiduciary, joint, service-provider, employer,\n   regulated-entity, and contractual roles for every data flow.\n6. Assess affected categories, sensitivity, volume, identifiability, people,\n   duration, actors, encryption, misuse, reversibility, vulnerability, and likely\n   physical, financial, identity, discrimination, confidentiality, or other harm.\n7. Build a jurisdiction-by-jurisdiction notification matrix covering threshold,\n   recipient, deadline, content, form, language, authority, phased updates, and records.\n8. Prepare consistent regulator, individual, customer, insurer, board, partner,\n   employee, and public communications; separate known facts from investigation.\n9. Address support such as credential resets, monitoring, contact channels,\n   accessibility, child or vulnerable-person measures, and complaint handling.\n10. Track eradication, recovery, validation, root cause, control improvements,\n    vendor accountability, evidence retention, lessons, and closure approval.\n\n## Output\n\nProvide the incident chronology, data and role map, harm assessment, notification\nmatrix, decision log, draft notices, communication plan, remediation tracker, and\npost-incident report.\n\n## Guardrails\n\nDo not conceal, speculate, destroy evidence, promise no harm, or delay escalation\nwhile waiting for perfect facts. Do not use one jurisdiction's deadline globally.\nProtect privilege without obstructing duties and obtain qualified forensic,\nprivacy, sector, employment, and local-law support where needed.\n"
}