/generate-gdpr-ropa

Generates a draft GDPR Article 30 ROPA from code context files. The output is a draft — it requires legal review before use as a compliance document. Your job is to make that review fast by capturing everything that can be derived from the code without asking a lawyer.

What you're doing and why

MODULE_MANIFEST.md and BEHAVIORAL_CONTRACTS.md already document what data each module handles, where it flows, who receives it, and what security measures are in place. A ROPA is largely this same information presented in the specific format regulators and DPOs need to inspect. Without this skill, someone has to manually trace data flows across every module and interview every team. With it, the draft is generated in one session and the lawyer review focuses on legal analysis rather than archaeology.

The risk is overconfidence — a ROPA that looks complete but is missing processing activities because some modules lack context files. Flag every gap explicitly so the reviewer knows what to verify.

Arguments

• (none) — scans the entire repo
• --module path/to/module — generates a ROPA entry for one module only