<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-gdpr-data-processing
description: >-
  Audit GDPR data processing activities including lawful basis validation,
  data flow mapping, DPIA execution, consent management verification, and
  cross-border transfer assessment. Automate Article 30 records of processing
  and data subject rights fulfillment tracking.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - gdpr
  - data-protection
  - dpia
  - privacy
  - data-flow
  - consent-management
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing GDPR Data Processing

## Overview

The General Data Protection Regulation (EU 2016/679) requires organizations
processing personal data of EU residents to demonstrate lawful basis, implement
data protection by design, conduct DPIAs for high-risk processing, and maintain
records of processing activities (Art. 30). This skill automates data flow
discovery, processing record generation, and DPIA risk assessment.

Mode: `[MODE: PRIVACY]` — Data protection audit with regulatory mapping.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | For agent tooling |
| jq | `apt install jq` |
| nmap | `apt install nmap` for data flow discovery |
| OpenSSL | For encryption validation |

## Key Concepts

### GDPR Lawful Bases (Article 6)

| Basis | Article | Use Case |
|---|---|---|
| Consent | 6(1)(a) | Marketing, analytics, non-essential cookies |
| Contract | 6(1)(b) | Service delivery, order processing |
| Legal obligation | 6(1)(c) | Tax records, AML/KYC, employment law |
| Vital interests | 6(1)(d) | Medical emergencies |
| Public interest | 6(1)(e) | Government functions |
| Legitimate interest | 6(1)(f) | Fraud prevention, IT security, direct marketing |

### Data Flow Mapping

```
Data Subject → Collection Point → Processing System → Storage → Transfer
     │              │                    │               │          │
     │              ▼                    ▼               ▼          ▼
     │         Art.13/14            Art.6 basis     Art.5(1)(e)  Art.44-49
     │         Privacy notice       documented     retention     adequacy/
     │         at collection        per purpose    policy set    SCCs/BCRs
     ▼
  Art.15-22
  Data subject
  rights portal
```

### Article 30 — Record of Processing Activities

```yaml
processing_activity:
  name: "Customer order processing"
  controller: "Acme Corp"
  dpo_contact: "dpo@acme.example.com"
  purposes:
    - "Order fulfillment"
    - "Payment processing"
  lawful_basis: "6(1)(b) — contractual necessity"
  data_subjects:
    - "Customers"
    - "Delivery recipients"
  personal_data_categories:
    - "Name, address, email"
    - "Payment card details (tokenized)"
    - "Order history"
  recipients:
    - "Payment processor (Stripe)"
    - "Shipping provider (DHL)"
  transfers:
    - destination: "United States"
      safeguard: "EU-US Data Privacy Framework"
  retention: "7 years (tax obligation)"
  technical_measures:
    - "AES-256 encryption at rest"
    - "TLS 1.3 in transit"
    - "Role-based access control"
    - "Pseudonymization of analytics data"
```

### DPIA Risk Matrix

| Risk Factor | Low | Medium | High |
|---|---|---|---|
| Data sensitivity | Public data | Contact info, financial | Health, biometric, children |
| Data volume | <1,000 subjects | 1K–100K subjects | >100K subjects |
| Automated decisions | None | Profiling without legal effect | Art. 22 automated decisions |
| Cross-border transfer | EEA only | Adequate countries | Non-adequate without SCCs |
| New technology | Established | Emerging | Novel surveillance/tracking |

### Automated Audit Checks

```bash
# Discover databases potentially storing personal data
nmap -sT -p 3306,5432,27017,6379,9200 --reason 10.0.0.0/24

# Check encryption on database connections
openssl s_client -connect db.example.com:5432 -starttls postgres 2>&1 | \
  grep -E "(Protocol|Cipher)"

# Verify data retention policies (PostgreSQL)
psql -c "SELECT schemaname, tablename, 
  pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename))
  FROM pg_tables WHERE schemaname = 'public';"

# Check access logs for data subject access
grep -c "GET /api/v1/user/data-export" /var/log/nginx/access.log

# Verify consent records exist
curl -s http://localhost:8080/api/consent/stats | jq '.total_consents'
```

## Workflow

### Step 1: Map Data Processing Activities

```bash
node scripts/agent.js --action map --scope "Customer Platform" \
  --output /tmp/gdpr-map.json
```

### Step 2: Assess Processing Against GDPR Requirements

```bash
node scripts/agent.js --action assess --input /tmp/gdpr-map.json \
  --output /tmp/gdpr-assess.json
```

### Step 3: Generate DPIA Report

```bash
node scripts/agent.js --action dpia --input /tmp/gdpr-assess.json \
  --output /tmp/gdpr-dpia.json
```

## Verification

- [ ] All processing activities documented per Article 30
- [ ] Lawful basis identified and documented for each purpose
- [ ] Privacy notices (Art. 13/14) validated at collection points
- [ ] DPIA completed for high-risk processing activities
- [ ] Cross-border transfers have adequate safeguards (SCCs/DPF)
- [ ] Data subject rights portal functional (Art. 15–22)
- [ ] Retention periods defined and automated deletion configured
- [ ] Data breach notification procedure tested (Art. 33 — 72 hours)

## References

- [GDPR Full Text (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [EDPB Guidelines](https://edpb.europa.eu/our-work-tools/general-guidance/)
- [ICO DPIA Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/)
- [CNIL DPIA Tool (PIA)](https://www.cnil.fr/en/open-source-pia-software)
