korean-privacy-terms: policy drafts from a Claude Code skill

A prompt-driven generator for four legal systems

The project is a Claude Code skill, and its stated purpose is generating privacy policies and terms of service from the law of Korea, Japan, the EU and the United States. The description says it reflects the personal information protection policy drafting guidelines of 2025-04-21 and the amended personal information protection law of March 2026, and that version 4.1 adds support for the Japanese APPI.

So the mechanism is a conversation, not a document pipeline. You invoke a skill, the skill asks you questions, and the answers determine which templates get filled in. That framing matters for how you evaluate it. This is a first draft generator with a legal corpus behind it, not a policy management product and not a scanner that tells you whether your current policy is compliant.

The statute coverage is listed explicitly. Korea is covered by PIPA together with the act on fair competition and regulation of terms of service and the electronic commerce act. The EU by GDPR with the CRD, the DSA and ePrivacy. The United States by CCPA and CPRA plus major state laws. Japan, new in 4.1, by the APPI with the consumer contract act and the specified commercial transactions act. Chinese PIPL is on the roadmap rather than implemented, in ROADMAP.md.

The version history is a good summary of the project's direction. v2.3.0 in April 2026 added an EU GDPR interview section, v3.0.0 the same day introduced the sub-skill system, and v4.1.0 in August 2026 added the US and Japan jurisdictions. The last push to the repository was on 2026-08-29.

One entry point and a directory of sub-skills

Version 4.1 restructured the project into one entry point and a set of sub-skills, with the table in the README listing the commands and their purpose.

The entry point is privacy-terms, which routes through a numbered menu to the sub-skill you need. The sub-skills are privacy-kr for Korean PIPA only, privacy-eu for EU GDPR only in English, privacy-us for US CCPA and CPRA only in English, privacy-jp for Japanese APPI only in Japanese, privacy-global for Korea and EU combined, and privacy-global-jp for Korea and Japan combined. The command list is short: the entry point, six jurisdiction commands, and the two bilingual variants.

A legacy SKILL.md remains at the repository root for compatibility with the 2.x layout, so an existing installation keeps working across the upgrade.

The triage that decides which of these you end up in was added in 2.1 and is described as automatic branching by service type. The first three questions set the jurisdiction, the language and the scope of the follow-up questions: who the service targets, Korean only, overseas mainly, or global; which region the overseas audience is in, EU, US, Asia or worldwide; and where the operating entity is based, Korea or overseas. After that the model asks only the questions the relevant law requires, and the README claims an average completion time of under ten minutes.

It is worth being clear that this narrows the field rather than deciding the answer. Whether a specific service actually falls under PIPA or GDPR is a legal question, and the skill's own framing is that it drafts documents for a service you describe.

Jurisdictions, checklists and conditional sections

The shared assets live in a jurisdictions directory, and the layout shows how the coverage is organised. Korea has a directory with four MDX templates, a privacy policy and terms of service in Korean and in English. The EU directory holds a GDPR checklist, a terms checklist, a privacy notice template and a terms of service template. The US directory has a CCPA checklist and a privacy policy template. The Japan directory, new in 4.1, has an APPI checklist and Japanese privacy policy and terms templates.

Alongside them is a references directory described as the law references, ten for Korea and one for Japan, the new one being the Japanese APPI statute checklist.

The service type changes the output. The README lists SaaS, shopping malls, communities, blogs, fintech and AI services, and says the clauses change automatically according to the type. That is a template selection mechanism, and it is the part of the design that makes the output usable rather than generic.

Then there are the conditional sections. Sections are generated only when they apply, and the list is specific: users under 14, AI automated decision making, foreign business operators, targeted advertising, sensitive information, and the right to request transmission. For a service that processes children's data or makes automated decisions about people, that list is the difference between a usable document and a liability.

On the statute side, the README tracks the personal information protection law promulgated on 2026-03-10 with effect from 2026-09-11 and a penalty of 10 percent of revenue, the right to request transmission under article 35-2 effective 2025-03-13, the right to respond to automated decisions under article 37-2 effective 2024-03-15, the generative AI privacy guideline of August 2025, and standard terms no. 10023 from the competition authority. On the EU side it lists the eight GDPR rights, the legal basis under article 6 and the article 83 fines of 4 percent or 20 million euro.

Keeping that list current is the ongoing work, and the project asks for help with exactly that in its contribution section.

Consent components built for a Next.js front end

The skill does not only produce text. It also emits UI, and the component list is the part that determines whether the output can be shipped.

There is a consent modal based on shadcn/ui that switches between Korean and English automatically, and a cookie consent banner with four categories, necessary, functional, analytics and advertising, with a GDPR opt-in mode. There are six labelling cards in the style of a Korean messaging app, and templates for the privacy policy and terms of service pages, with the Pretendard font and a black and white monochrome look as the default.

The target project list is narrow on purpose: Next.js 13 or later with the App Router recommended, Tailwind CSS, shadcn/ui with automatic installation support, and MDX with automatic installation support.

Output is multilingual in a specific way. Korean only, English only and Japanese only are supported, as are Korean with English and Korean with Japanese, and the consent modal and the cookie banner can switch at runtime through a locale property accepting ko, en or ja. The README frames the whole feature set as the point of a bilingual document, since a Korean operator with EU users needs the same policy in two languages with the right legal content in each, not one translation of the other.

The assets directory holds the React component sources and a config directory with the next.config and mdx-components templates, so the generated output is a starting point that your own build and design system can absorb rather than a black box that has to be taken as it comes.

Installing it into Claude Code, Codex CLI or a project

The installation is a clone plus a loop that registers each sub-skill under the name the command uses, because the skills live in a nested directory but the commands are flat.

For Claude Code, the repository is cloned into the skills directory and each sub-skill is symlinked:

mkdir -p ~/.claude/skills
cd ~/.claude/skills
git clone https://github.com/kimlawtech/korean-privacy-terms.git
for s in privacy-terms privacy-kr privacy-eu privacy-us privacy-jp privacy-global privacy-global-jp; do
  ln -sf ~/.claude/skills/korean-privacy-terms/skills/$s ~/.claude/skills/$s
done

The OpenAI Codex CLI uses the same SKILL.md format, so only the path changes, and the README copies the directories rather than linking them:

mkdir -p ~/.codex/skills
cd ~/.codex/skills
git clone https://github.com/kimlawtech/korean-privacy-terms.git
for s in privacy-terms privacy-kr privacy-eu privacy-us privacy-jp privacy-global privacy-global-jp; do
  cp -RL ~/.codex/skills/korean-privacy-terms/skills/$s ~/.codex/skills/$s
done

After that you can list them with the /skills command in Codex CLI, or call one by mentioning it in the form $privacy-jp.

There is also a project scoped install, which copies the whole repository into a project directory:

mkdir -p /your-project/.claude/skills
cp -r ~/.claude/skills/korean-privacy-terms /your-project/.claude/skills/

Then in Claude Code you run /privacy-terms, or you ask in natural language. The README gives three example phrasings, asking for a privacy policy and terms of service, asking for a cookie banner, and asking for a signup consent modal, which is a useful indication of the intended granularity: the skill can be asked for the whole document or for one component.

The disclaimer, the licence and where the work is heading

The legal disclaimer is a separate document, DISCLAIMER.md, and the README states plainly that the documents the skill generates are reference drafts and are not legal advice. Lawyer review before deploying to a real service is described as mandatory.

The same section quantifies the stakes it is trying to help you avoid, in the local currency. A privacy policy that is not published carries a fine of up to 50 million won, serious violations carry a penalty of 10 percent of revenue under the regime effective 2026-09-11, and improper use of the standard terms mark carries a fine of up to 50 million won.

The licence is Apache-2.0, with the file at the root and a NOTICE file alongside it, so the templates and the scripts can be reused and modified with attribution.

The project is built by a Korean law AI hub called SpeciAI, which states that it releases the tools it uses in legal, tax, labour, accounting and medical practice as open source while operating the finished product on speciai.kr, and the homepage in the repository metadata points at that services page. The community is a Discord, and the README says the skill updates and announcements are posted there.

For contributors, the README asks for pull requests and names four specific gaps: templates for more service types such as edtech and healthcare, multilingual coverage with English privacy policies, ports of the components to Vue and Svelte, and updates that reflect the latest statutes. The repository also carries a ROADMAP.md for the long term expansion, a CHANGELOG.md, a TESTING.md and an examples directory with an ecommerce sample.

Editorial conclusion

Adopt korean-privacy-terms if you run a Korean facing service and need a first draft of a privacy policy and terms of service that reflects the current statute text, especially if your project is already Next.js with Tailwind and shadcn/ui, since the generated components assume that stack. Do not adopt it as a compliance instrument or as a substitute for legal review, because the project states that its output is a reference draft and that lawyer review is required before deployment, and the statute list it tracks is a moving target. Verify first which jurisdictions your service actually falls under, since the triage questions only narrow the field rather than determine it, that the statute references in the jurisdictions directory match the version in force when you deploy, and that the consent components your front end needs, the modal and the banner with their locale switching, are the ones the skill writes.

Frequently asked questions

Official sources

1. kimlawtech/korean-privacy-terms on GitHub
2. License: Apache-2.0
3. Project website
4. README
5. Releases