GDPR Audit

A detection-guide-driven audit skill. Reads code / plan / schema / IaC artifacts and returns a structured findings report with GDPR article citations, severity, confidence, evidence, and recommended fixes.

Output is "technical GDPR audit of provided materials" — never "GDPR compliant" or "non-compliant". Compliance is a legal determination; this skill provides technical evidence and gap analysis. Always include the disclaimer at the end of the report.

When to use

• Auditing an existing codebase, repo, or directory tree
• Reviewing an implementation plan, design doc, or RFC for GDPR implications
• Reviewing a database schema or data model for personal data handling
• Reviewing IaC (Terraform / Pulumi / CDK / k8s manifests) for transfers, encryption, region constraints
• Pre-DPIA technical scoping
• Vendor onboarding (auditing the integration code of a new processor / SDK)

When NOT to use