Privacy Audit Skill

Goal

Ensure no PII leaks, all data flows are documented, and the codebase complies with applicable data protection regulations (GDPR, CCPA, HIPAA). Produce a data flow map and violation list.

Steps

1. Identify applicable regulations

   • Ask if unclear: "Which regulations apply to this project?" (GDPR, CCPA, HIPAA, PIPEDA, LGPD)
   • GDPR: European users or EU data processing
   • CCPA: California users
   • HIPAA: US healthcare data (PHI)

2. Scan codebase for PII exposure

   Automated scanning:

   # Semgrep with PII detection rules
   npx semgrep --config=p/pii src/