Audit Systems for GDPR Compliance

Audits systems, applications, code, privacy policies, and business processes for GDPR compliance gaps, grounded in the six Article 5 principles (lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality) and the six Article 6 legal bases for processing (consent, contract, legal obligation, vital interests, public task, legitimate interests). Technical assessment runs SQL queries against a database to surface likely personal-data columns (email/phone/address/name patterns) and audit retention periods, and reviews application code for consent verification per purpose, Article 30 processing-activity logging, and handling of Article 15-20 data-subject requests (access, rectification, erasure, portability). Privacy policies are checked against a 12-item Article 13 checklist covering controller identity, DPO contact, purposes and legal basis, recipient categories, international transfers, retention periods, and data-subject rights. High-risk processing triggers a DPIA using a defined YAML template (processing description, necessity/proportionality, a likelihood/severity risk assessment, and technical/organisational safeguards) for six flagged activity types - systematic public monitoring, large-scale special-category processing, automated decisions with legal effect, biometric or genetic data processing, and location/behavioral tracking. Security review covers encryption (a PBKDF2-derived key with 100,000 iterations feeding Fernet symmetric encryption) and Article 30 audit-trail logging. International transfers are checked against five valid mechanisms (adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, certification schemes, codes of conduct) with a 6-item SCC implementation checklist. Findings are output with a four-tier priority classification - Critical (30-day fix), High (90 days), Medium (6 months), Low (12 months) - each with specific, actionable remediation steps.

Use it to audit an existing system, codebase, or privacy policy against GDPR requirements and produce a prioritized remediation plan - not as a substitute for a qualified data-protection lawyer's sign-off on legal basis or cross-border transfer strategy.

Input is the system, database schema, application code, or privacy policy to assess. Output is a compliance gap analysis mapped to specific GDPR articles, a completed privacy-policy checklist, a DPIA where high-risk processing is present, and prioritized remediation recommendations with implementation timelines from 30 days to 12 months and resource estimates.

Assessment runs directly against SQL databases (schema introspection via information_schema.columns), application code (Python examples using cryptography's Fernet/PBKDF2HMAC), and structured DPIA templates in YAML - designed to plug into whatever stack already holds the personal data being assessed rather than requiring a specific compliance platform.

For engineering, security, and compliance teams running a GDPR gap analysis on a system or process. It maps every finding to a specific article - 5, 6, 13, 15-20, 30 - rather than giving generic advice, and structures the output so legal and engineering can act on the same prioritized list.

class GDPRDataEncryption:
    def __init__(self, password: bytes):
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=b'stable_salt_for_gdpr',  # Use random salt in production
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(password))
        self.cipher = Fernet(key)
    
    def encrypt_personal_data(self, data: str) -> str:
        """Encrypt personal data before storage"""
        return self.cipher.encrypt(data.encode()).decode()
    
    def decrypt_personal_data(self, encrypted_data: str) -> str:
        """Decrypt for legitimate access"""
        return self.cipher.decrypt(encrypted_data.encode()).decode()