goul4rt / lgpd-skills

What is lgpd-skills?

This is a Claude Code plugin bundle that turns your AI assistant into a Brazilian privacy law compliance auditor. It encodes LGPD (Lei 13.709/2018), ANPD resolutions, and the new ECA Digital law (15.211/2025) into 19 coordinated skills. One master skill orchestrates the flow while 18 specialized ones handle specific tasks: legal basis mapping, data inventory, ROPA generation, DPIA reports, incident response runbooks, consent ledgers, and vendor DPAs. Everything outputs versioned artifacts under a `.lgpd/` directory that you can commit to Git and review in pull requests. The plugin installs via a simple CLI command and works with natural language triggers like "audit our LGPD compliance" or "we had a data breach."

Why is it gaining traction?

Brazilian companies face real ANPD enforcement risk, and most developers lack legal expertise. This bridges that gap by encoding regulatory requirements directly into the development workflow. The orchestrator approach is clever—it pauses at critical checkpoints for human review instead of auto-generating legally binding documents. The incident response skill is particularly valuable: ANPD Resolution 15/2024 gives you three business days to notify them of breaches, and having a runbook ready can mean the difference between a fine and a warning. The ECA Digital coverage is timely since it just took effect in March 2026.

Who should use this?

Backend developers at Brazilian startups or companies with Brazilian users who need to ship LGPD-compliant features without becoming privacy lawyers. DevOps leads running legacy system audits who want a structured gap analysis before engaging external consultants. Product teams building features involving minors (ECA Digital) or international data transfers (ANPD Resolution 19/2024). It's less useful if you already have a mature DPO and legal team, or if your codebase has no Brazilian user data.

Verdict

A genuinely useful concept with solid regulatory coverage, but the 19-star count signals early-stage maturity. The disclaimer is appropriately prominent—this assists compliance work, it does not replace legal counsel. Worth installing if you operate in Brazil; just validate outputs with your DPO before publishing anything. The credibility score of 0.95% reflects the project's newness, not its quality.