---
name: gdpr-data-audit
enabled: true
description: |
  Use when performing gdpr data audit — gDPR data audit covering personal data
  mapping, lawful basis assessment, consent management, data retention policies,
  DSAR processes, and cross-border transfer compliance. Use for annual data
  audits, new system assessments, or regulatory preparation.
required_connections:
  - prefix: github
    label: "GitHub (for data schema review)"
config_fields:
  - key: system_name
    label: "System / Application Name"
    required: true
    placeholder: "e.g., customer-platform"
  - key: data_controller
    label: "Data Controller Entity"
    required: true
    placeholder: "e.g., Acme Corp (EU)"
  - key: processing_activities
    label: "Key Processing Activities"
    required: true
    placeholder: "e.g., user registration, analytics, marketing"
features:
  - COMPLIANCE
  - PRIVACY
---

# GDPR Data Audit Skill

Perform a GDPR data audit for **{{ system_name }}** operated by **{{ data_controller }}**.

## Workflow

### Step 1 — Personal Data Inventory (Article 30)

Create a Record of Processing Activities (ROPA):

| Data Category | Examples | Source | Storage | Retention | Lawful Basis |
|--------------|----------|--------|---------|-----------|-------------|
| Identity | Name, email, phone | User input | PostgreSQL | 3 years | Contract |
| Financial | Payment method | Stripe | Tokenized | 7 years | Legal obligation |
| Behavioral | Clickstream, IP | Auto-collected | BigQuery | 1 year | Legitimate interest |
| Special Category | Health, religion | N/A | N/A | N/A | N/A |

For each processing activity in {{ processing_activities }}:
1. **Purpose**: Why is this data processed?
2. **Categories of data subjects**: Customers, employees, prospects
3. **Recipients**: Internal teams, processors, third parties
4. **Transfers**: Any cross-border data transfers

### Step 2 — Lawful Basis Assessment (Article 6)

```
LAWFUL BASIS REVIEW
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Each processing activity has a documented lawful basis
[ ] Consent: freely given, specific, informed, unambiguous
[ ] Consent records stored with timestamp and scope
[ ] Consent withdrawal mechanism is as easy as giving consent
[ ] Legitimate interest: balancing test documented (LIA)
[ ] Contract: processing limited to what is necessary for performance
[ ] Legal obligation: specific regulation identified
[ ] No processing without a valid lawful basis
```

### Step 3 — Data Subject Rights (Articles 15-22)

```
DATA SUBJECT RIGHTS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Right of access (DSAR): process responds within 30 days
[ ] Right to rectification: mechanism to update personal data
[ ] Right to erasure: deletion workflow covers all data stores
[ ] Right to restriction: can flag data as restricted processing
[ ] Right to portability: export in machine-readable format (JSON/CSV)
[ ] Right to object: opt-out mechanism for marketing/profiling
[ ] Automated decision-making: human review available if applicable
[ ] Identity verification process for DSARs
[ ] DSAR tracking log maintained
```

### Step 4 — Consent Management

```
CONSENT MANAGEMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Cookie consent banner with granular choices (not pre-ticked)
[ ] Marketing consent separate from service terms
[ ] Consent version tracking (re-consent on policy change)
[ ] Under-16 processing has parental consent mechanism
[ ] Third-party data sharing consent is explicit and specific
[ ] Consent records exportable for audit
```

### Step 5 — Data Retention & Deletion

```
RETENTION & DELETION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Retention schedule defined per data category
[ ] Automated deletion/anonymization at retention expiry
[ ] Backup data included in retention policy
[ ] Deletion verification process (confirm data is purged)
[ ] Anonymization meets GDPR standard (not reversible)
[ ] Log data retention aligned with policy
```

### Step 6 — International Transfers (Chapter V)

```
CROSS-BORDER TRANSFERS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Transfer mechanisms identified (SCCs, adequacy decisions, BCRs)
[ ] Transfer Impact Assessment (TIA) completed
[ ] US transfers: supplementary measures documented post-Schrems II
[ ] Sub-processor list maintained and communicated
[ ] Cloud provider data residency confirmed
```

### Step 7 — Security & Breach (Articles 32-34)

```
SECURITY & BREACH
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[ ] Technical and organizational measures (TOMs) documented
[ ] Data Protection Impact Assessment (DPIA) completed for high-risk processing
[ ] Breach detection and 72-hour DPA notification process in place
[ ] Breach response team identified
[ ] Breach log maintained (even for non-reportable breaches)
```

## Counter-Rationalizations

| Shortcut | Counter | Why |
|----------|---------|-----|
| "We can skip some steps for this case" | Adapt the workflow steps, don't skip them | Skipped steps are where incidents and oversights originate |
| "The user seems to already know what to do" | Complete all workflow phases with the user | The workflow catches blind spots that experience alone misses |
| "This is a minor case, full process is overkill" | Scale the process down, don't turn it off | Minor cases become major when unstructured; the process scales, not disappears |
| "I'll fill in the details later" | Complete each section before moving on | Deferred details are forgotten; real-time capture is more accurate |
| "The template output isn't necessary" | Always produce the structured output format | Structured output enables comparison, audit trails, and handoff to other teams |

## Output Format

Produce a GDPR audit report with:
1. **Data inventory** (ROPA) with all personal data flows mapped
2. **Lawful basis** assessment per processing activity
3. **Rights compliance** checklist with process maturity
4. **Retention schedule** with automated enforcement status
5. **Transfer mechanisms** and supplementary measures
6. **Risk findings** with remediation priorities and DPO review status