legal:legal-response — Generate Reply from Templates

legal:legal-response — Generate Reply from Templates

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Generate a templated response to a common inbound legal inquiry, customize with specific facts, and gate against situations that should not use a template.

Important: This skill assists with legal workflows. Generated responses are drafts and must be reviewed by qualified counsel before sending — especially for any regulated communication, anything to a regulator/court, anything touching breach or criminal exposure, and anything cross-border.

When to use vs. adjacent legal skills

Defining characteristic: REACTIVE + inbound inquiry + templated reply + escalation gate.

Common invocations

• "Respond to this DSAR from a German user requesting deletion"
• "Draft a litigation hold for engineering and product on matter Acme v. Us"
• "Vendor sent us a question about Section 5.2 of our MSA — draft a reply"
• "Sales needs me to send our standard NDA to a prospect"
• "Got a civil subpoena — start an acknowledgment draft (counsel will finalize)"
• "EU user asked how we handle international transfers — privacy inquiry reply"
• "Annual hold reaffirmation reminder for active matters"

Workflow

Step 1 — Identify inquiry type

Common types:

• dsar (or data-subject-request) — access / deletion / correction / portability / opt-out
• hold (or discovery-hold, litigation-hold) — initial notice, reminder, modification, release
• vendor — vendor legal question, audit letter, COI request, attestation
• nda — send standard NDA, decline NDA, accept counterparty NDA cover note (run legal:triage-nda first to classify)
• privacy — privacy/cookie/transfer inquiry from an individual
• subpoena — subpoena or legal-process acknowledgment (ALWAYS counsel-gated)
• insurance — claim notification or reservation-of-rights response
• custom — bespoke template

If type is ambiguous, list categories and ask.

Step 2 — Run the escalation gate FIRST (before drafting)

ALWAYS-ESCALATE situations — do NOT generate a final templated response:

1. Subpoena, warrant, court order, or any legal process — draft labeled "DRAFT — FOR COUNSEL REVIEW ONLY"; route to outside / senior counsel
2. Regulator or government-agency letter (FTC, state AG, DPA, SEC, CFPB, DACO in PR, FBI, etc.)
3. Sub-processor or internal data-breach notification — this is incident response, not a templated reply. Route to incident-response + counsel; if a customer-facing notice is needed, draft is custom and counsel-led
4. Threatened or pending litigation (cease-and-desist, demand letter, tort claim)
5. Criminal exposure of any kind
6. Media attention involved or likely
7. Multi-jurisdiction conflict (e.g., GDPR right-to-erasure vs. US litigation hold)
8. Unprecedented matter with no prior team handling
9. Executive / board-level subjects of the matter

Category-specific escalation triggers (continue templating only if NONE apply):

When triggered: STOP. Surface the trigger to the user, name it, recommend escalation path (in-house counsel → outside firm if needed), and offer a labeled DRAFT — FOR COUNSEL REVIEW ONLY rather than a final reply.

Step 3 — Load template

Look in local settings (e.g., legal.local.md, templates directory). If none exists for this type, offer to create one (see Template Creation Guide) and provide a reasonable default structure in the meantime.

Step 4 — Gather customization details

Prompt for the variables required by the chosen template. Minimum sets:

• DSAR: requester name + contact, request type, data scope, applicable reg (GDPR Art. 15/17/etc., CCPA §1798.105, etc.), receipt date, response deadline (GDPR: 1 month + 2-month extension; CCPA: 45 days + 45-day extension; PR Ley 111-2005 breach timing is separate)
• Hold: matter name + reference, custodians, scope (date range, data types, systems, channels), outside-counsel contact, effective date, acknowledgment deadline
• Vendor: vendor name, agreement reference, specific question, relevant clause(s)
• NDA: business-team contact, counterparty, purpose, mutual vs. unilateral, special asks
• Privacy inquiry: individual's question, reference to current privacy policy section, jurisdiction
• Subpoena (draft only): case ref, court, served-on date, response date, type of process
• Insurance: policy number, coverage period, matter description, timeline

Step 5 — Generate draft

Customize the template. Verify:

• Correct names, dates, references
• Correct applicable regulation cited (e.g., don't cite CCPA for an EU resident)
• Correct response deadline calculated from receipt date
• Tone calibrated (see below)
• Required legal elements present (e.g., DSAR must inform of right to lodge complaint with supervisory authority under GDPR Art. 13(2)(d))
• Signature block + correct contact

Step 6 — Tone calibration

• Audience: internal vs. external; business vs. legal; individual vs. regulator
• Relationship: new counterparty vs. existing partner vs. adversarial
• Sensitivity: routine vs. contentious vs. regulatory
• Urgency: standard vs. expedited Default DSAR/privacy tone: plain-English, respectful, regulation-cited. Default hold tone: imperative, formal, marked PRIVILEGED & CONFIDENTIAL. Default vendor tone: professional, contract-anchored, non-binding caveat where needed. Default NDA tone: brief, transactional. Default subpoena draft tone: formal, terse, fact-only, all substance counsel-flagged.

Step 7 — Present draft + post-send actions

Always present for user review. Offer to draft an email via connected MCP if available. Surface:

• Response deadline (and offer calendar reminder)
• Logging requirement (DSAR register, hold tracker, etc.)
• Follow-up checkpoints (acknowledgment, fulfillment, closure)

Response categories (template scaffolds)

1. DSARs

Sub-types: receipt acknowledgment, identity-verification request, fulfillment (access/delete/correct), partial denial, full denial, extension. Required elements: applicable reg, deadline, verification, supervisory-authority complaint right, contact.

2. Litigation / discovery holds

Sub-types: initial notice, reminder, scope modification, release. Required: matter ref, scope (date / data / systems / channels), spoliation prohibition, acknowledgment requirement, contact. Mark PRIVILEGED & CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION.

3. Privacy inquiries

Sub-types: cookie/tracking, policy questions, data sharing, children's data, cross-border transfer (SCCs / UK IDTA / adequacy).

4. Vendor legal questions

Sub-types: contract status, amendment request, compliance certification, audit response, COI request.

5. NDA send / decline / accept-cover

Sub-types: send standard, decline with reason, accept counterparty (cover note only — redline is a contract-review task). Run legal:triage-nda first if the NDA hasn't been classified.

6. Subpoena / legal process (counsel-gated)

Sub-types: receipt acknowledgment, objection letter, extension request, compliance cover. Templates are starting frameworks ONLY; final response is counsel-led every time.

7. Insurance notifications

Sub-types: initial claim notification, supplemental info, reservation-of-rights response.

Output format

## Generated Response: [inquiry type]

ESCALATION CHECK: [PASS — no triggers] OR [BLOCKED — see below]

**To:** [recipient]
**Subject:** [subject]

---
[Body]
---

### Required next steps
1. [Calendar reminder for deadline]
2. [Log entry: DSAR register / hold tracker / etc.]
3. [Counsel review checkpoint, if applicable]

Template management (brief)

Templates should live in local settings with: category, use case, escalation triggers (when NOT to use), required variables, body, follow-up actions, last-reviewed date. Lifecycle: create → counsel review → publish → use → feedback → update → retire.

Notes

• Always present the draft for user review before send
• For regulated responses (DSAR, subpoena, insurance), surface the deadline and offer a calendar reminder
• If a template was modified during use, suggest updating the source template
• Cybersec / PR-context callouts:
  • DSARs from EU residents: GDPR timeline (1 month, +2 extension)
  • DSARs from CA residents: CCPA timeline (45 days, +45 extension)
  • PR Ley Núm. 111-2005 governs breach-notification timing — breach notices are NOT in scope of this skill (escalate)
  • Sub-processor changes go through legal:compliance-check (forward-looking) and the customer-notice template here (reactive notice once decided)