Audit Systems for GDPR Compliance

GDPR Compliance Checker organizes auditing of systems, applications, code, privacy policies, and business processes. It connects data-protection principles to technical inspection and actionable remediation. The framework covers lawfulness, fairness, transparency, purpose limitation, minimization, accuracy, storage limitation, integrity, and confidentiality, then examines the processing basis associated with a particular purpose.

The processing-basis review distinguishes consent, contract, legal obligation, vital interests, public task, and legitimate interests. It considers whether consent is freely given, specific, informed, and unambiguous, and whether an interests-based approach includes balancing against individual rights. This provides the structure for identifying gaps rather than treating encryption alone as complete compliance.

Use the skill for a review that spans both software behavior and organizational processes. Database work looks for fields likely to contain personal information and examines the age and retention of records. Application review examines purpose-specific consent, processing records, and handling of access, correction, erasure, and portability requests.

A narrow code-only review cannot cover the framework's policy, training, transfer, and assessment elements. Privacy notices also need controller and applicable officer contacts, purposes and bases, recipients, transfer details, retention criteria, rights, consent withdrawal, complaint information, provision requirements, and automated-decision information. The resulting findings should identify specific changes, resource needs, and implementation steps.

Inputs include schemas, stored records, application collection logic, consent purposes, request handlers, privacy notices, processing activities, and transfer arrangements. Outputs are compliance-gap findings, risk assessments, safeguards, and prioritized recommendations.

Impact assessment work identifies monitoring, sensitive-data processing at scale, consequential automated decisions, biometric identification, genetic data, and location or behavioral tracking. The structured assessment captures purpose, data categories, subjects, recipients, necessity, proportionality, legal basis, likelihood, severity, and technical or organizational protections.

Processing records include controller, purpose, legal basis, data and subject categories, recipients, third-country transfers, retention, and security measures. The supplied activity-logging example persists the assembled record:

        self.audit_store.create_record(record)

Remediation categories range from unlawful processing and absent legal basis to significant security gaps, incomplete policies or training, and documentation improvements. The skill assigns implementation windows by priority as part of its planning framework, with clear steps and resource requirements for each finding.

SQL patterns support storage and retention inspection. Python patterns illustrate consent management, subject-request dispatch, encryption, and activity logging. The encryption example uses Fernet and password-based derivation, with an explicit instruction to use random salt in production. These patterns connect privacy requirements with application behavior and audit evidence.

International-transfer review covers adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, certification, and codes of conduct. Its SCC checklist examines clause version and module, local-law impact assessment, additional safeguards, ongoing review, and suspension or termination procedures. Organizational measures such as policies, training, and audit procedures accompany encryption, access control, and anonymization.