# Evals: gdpr-privacy

These cases are routing and coverage checks, not an automated pass/fail suite. Read `cases.yaml` against `SKILL.md`. For each `should_trigger` prompt, confirm the description and body would plausibly fire this skill and not a sibling (note the Spanish and Catalan triggers and the non-obvious consent-vs-legitimate-interest and US-transfer cases); for each `should_not_trigger` prompt, confirm the named `route_to` sibling is the better home and that this skill's boundary section would defer to it. For the `capability` case, have a human or a harness LLM produce the response and check it hits every `must_include` item — above all that it starts from a processing inventory, assigns a basis per purpose, fixes reject-parity and block-until-consent on the banner, handles the US transfers with SCCs + a transfer impact note, respects the one-month DSAR clock, and emits the counsel/DPO-review boundary while treating the Digital Omnibus as a proposal. There is no scripted assertion here. The separate `scripts/verify.sh` is the only automated check, and it inspects an emitted artifact (policy / banner / DPA), not these cases.