<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# GDPR Data Processing Audit — API Reference

## Data Discovery Commands

```bash
# Discover databases on network
nmap -sT -p 3306,5432,27017,6379,9200 --reason --open <NETWORK>

# Check database encryption in transit
openssl s_client -connect <HOST>:5432 -starttls postgres 2>&1 | grep Protocol

# PostgreSQL — list tables with PII indicators
psql -c "SELECT table_name, column_name FROM information_schema.columns
  WHERE column_name ~* '(email|phone|name|address|ssn|dob|birth)'"

# MongoDB — find collections with personal data fields
mongosh --eval 'db.getCollectionNames().forEach(c => {
  var sample = db[c].findOne();
  if (sample) printjson({collection: c, fields: Object.keys(sample)});
})'
```

## Consent Management Validation

```bash
# Verify consent API endpoint
curl -s http://localhost:8080/api/consent/stats | jq '.'

# Check consent record structure
curl -s http://localhost:8080/api/consent/<USER_ID> | \
  jq '{purposes: .purposes, timestamp: .granted_at, version: .policy_version}'

# Validate consent withdrawal mechanism
curl -X DELETE http://localhost:8080/api/consent/<USER_ID>/marketing
```

## Data Subject Rights (Art. 15–22)

```bash
# Test right of access (Art. 15)
curl -s http://localhost:8080/api/user/<ID>/data-export | jq '.status'

# Test right to erasure (Art. 17)
curl -X POST http://localhost:8080/api/user/<ID>/erasure-request

# Test data portability (Art. 20)
curl -s http://localhost:8080/api/user/<ID>/portable-data \
  -H "Accept: application/json" -o user_data.json

# Verify erasure completion
curl -s http://localhost:8080/api/user/<ID>/erasure-status | jq '.completed'
```

## Cross-Border Transfer Assessment

```bash
# Check data residency of cloud resources
aws s3api get-bucket-location --bucket <BUCKET>
aws rds describe-db-instances --query 'DBInstances[].AvailabilityZone'

# Verify Standard Contractual Clauses documentation
find /opt/compliance/contracts/ -name "*SCC*" -o -name "*standard_contractual*"
```

## GDPR Article Quick Reference

| Article | Topic | Audit Focus |
|---------|-------|-------------|
| 5 | Principles | Purpose limitation, minimization, accuracy |
| 6 | Lawful basis | Documented basis per processing activity |
| 13–14 | Transparency | Privacy notices at collection points |
| 15–22 | Data subject rights | Access, rectification, erasure, portability |
| 25 | DPbD | Privacy by design in system architecture |
| 30 | ROPA | Records of processing activities |
| 32 | Security | Encryption, pseudonymization, resilience |
| 33–34 | Breach notification | 72-hour supervisory authority notification |
| 35 | DPIA | Impact assessment for high-risk processing |
| 44–49 | Transfers | Adequacy, SCCs, BCRs, derogations |
