GDPR Compliance

Overview

This skill helps AI agents implement GDPR compliance across web applications. It covers the full lifecycle: auditing where personal data lives, building consent management, handling data subject requests (access, deletion, portability), enforcing retention policies, and generating documentation.

Instructions

PII Audit

1. Scan database schemas (Prisma, SQL migrations, Sequelize models, TypeORM entities) for PII fields. Flag these patterns:
   • Direct identifiers: email, name, full_name, phone, address, ssn
   • Indirect identifiers: ip_address, device_id, geo_*, lat, lng, user_agent
   • Sensitive data: date_of_birth, gender, health_*, ethnicity
2. Scan application code for PII in logs: search for console.log, logger.*, winston.* calls that include user objects or request IPs.
3. Scan third-party integrations: check for API calls that send user data (analytics, email providers, payment processors, CRMs).
4. Output a Data Flow Inventory as a markdown table: | Data Type | Storage Location | Shared With | Legal Basis | Retention Period |