<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# GDPR Compliance Audit — API Reference

## Run Audit

```bash
# Full audit across all domains
node scripts/agent.js --action audit --domains "all"

# Specific domains
node scripts/agent.js --action audit \
  --domains "data_subject_rights,breach_notification,security"
```

### Available Domains

| Domain | GDPR Articles | Items |
|--------|--------------|-------|
| principles | Art. 5 | 7 |
| lawful_basis | Art. 6, 9 | 4 |
| data_subject_rights | Art. 12–22 | 8 |
| security | Art. 32 | 3 |
| breach_notification | Art. 33–34 | 3 |
| international_transfers | Art. 44–49 | 3 |
| accountability | Art. 28, 30, 35, 37 | 4 |

## Gap Analysis

```bash
node scripts/agent.js --action gap-analysis --findings /tmp/gdpr_audit.json
```

## ROPA Completeness Check

```bash
node scripts/agent.js --action ropa-check \
  --processing-activities '[{"name":"payroll","basis":"contract","categories":["employee_data"]}]'
```

### Art. 30 Required Fields

| Field | Description |
|-------|-------------|
| controller_name | Name and contact details of controller |
| purposes | Purposes of processing |
| data_categories | Categories of personal data |
| recipients | Recipients including third countries |
| international_transfers | Transfers to third countries and safeguards |
| retention_periods | Envisaged time limits for erasure |
| security_measures | Description of technical/organizational measures |

## Severity Levels

| Level | Response Time | Examples |
|-------|--------------|---------|
| Critical | Immediate | No lawful basis, no breach process |
| High | Within 30 days | Missing ROPA, incomplete rights processes |
| Medium | Within 90 days | Accuracy gaps, minor documentation issues |
