<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-gdpr-compliance
description: >-
  Audit organizational GDPR compliance across Articles 5-49 including lawful basis,
  data subject rights, breach notification, international transfers, ROPA, and
  DPO requirements with structured gap analysis.
domain: cybersecurity
subdomain: privacy-engineering
tags:
  - gdpr
  - audit
  - compliance
  - ropa
  - dpo
  - data-subject-rights
  - breach-notification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
  mitre-attack: []
---

# Auditing GDPR Compliance

## Overview

GDPR compliance auditing systematically evaluates an organization's adherence to the
General Data Protection Regulation across processing principles (Art. 5), lawful bases
(Art. 6), data subject rights (Arts. 12–22), security measures (Art. 32), breach
notification (Arts. 33–34), and accountability obligations (Art. 30). This skill
produces structured audit findings with gap analysis and remediation priorities.

Mode: `[MODE: PRIVACY]` — Regulatory compliance audit.

## Prerequisites

- Understanding of GDPR Chapters I–XI
- Access to ROPA (Records of Processing Activities)
- Privacy policies, consent records, DPA contracts
- Breach register and incident response procedures
- Python 3.10+ for automated compliance checking

## Key Concepts

### GDPR Compliance Domains

| Domain | Articles | Key Requirements |
|--------|----------|------------------|
| Principles | Art. 5 | Lawfulness, fairness, transparency, minimization, accuracy, storage limitation, integrity |
| Lawful Basis | Art. 6, 9 | Consent, contract, legal obligation, vital interest, public interest, legitimate interest |
| Transparency | Art. 12–14 | Privacy notice, information at collection, information without collection |
| Data Subject Rights | Art. 15–22 | Access, rectification, erasure, portability, restriction, objection, automated decisions |
| Controller Obligations | Art. 24–31 | DPbD, joint controllers, processors, ROPA |
| Security | Art. 32–34 | Appropriate measures, breach notification (72h), communication to subjects |
| Transfers | Art. 44–49 | Adequacy, SCCs, BCRs, derogations |
| DPO | Art. 37–39 | Designation, position, tasks |

### Audit Checklist CLI

```bash
# Run full GDPR compliance audit
node scripts/agent.js --action audit \
  --domains "all" --output /tmp/gdpr_audit.json

# Audit specific domain
node scripts/agent.js --action audit \
  --domains "data_subject_rights,breach_notification" \
  --output /tmp/rights_audit.json

# Generate gap analysis from audit findings
node scripts/agent.js --action gap-analysis \
  --findings /tmp/gdpr_audit.json --output /tmp/gap_report.json

# Check ROPA completeness
node scripts/agent.js --action ropa-check \
  --processing-activities '[
    {"name":"payroll","basis":"contract","categories":["employee_data"]},
    {"name":"marketing","basis":"consent","categories":["email","name"]}
  ]' --output /tmp/ropa_check.json
```

## Workflow

### Step 1: Scope the Audit

```bash
node scripts/agent.js --action audit --domains "all"
```

### Step 2: Evaluate Each Domain

Review documentation, technical controls, and processes against GDPR requirements.

### Step 3: Generate Gap Analysis

```bash
node scripts/agent.js --action gap-analysis --findings /tmp/gdpr_audit.json
```

### Step 4: Prioritize Remediation

High-severity gaps (e.g., missing breach notification, no lawful basis) first.

### Step 5: Document and Report

Produce audit report for management and supervisory authority if requested.

## Verification

- [ ] All GDPR compliance domains assessed
- [ ] Lawful basis identified for every processing activity
- [ ] ROPA complete per Art. 30 requirements
- [ ] Data subject rights processes operational and tested
- [ ] Breach notification procedure documented and rehearsed (72h SLA)
- [ ] International transfer mechanisms validated (SCCs, adequacy)
- [ ] DPO designated where required (Art. 37)
- [ ] Gap analysis with prioritized remediation plan produced

## References

- [GDPR Full Text](https://gdpr-info.eu/)
- [EDPB Guidelines and Opinions](https://edpb.europa.eu/our-work-tools/general-guidance_en)
- [ICO Accountability Framework](https://ico.org.uk/for-organisations/accountability-framework/)
- [CNIL GDPR Compliance Checklist](https://www.cnil.fr/en/gdpr-developers-guide)
- [GDPR Article 30 — Records of Processing Activities](https://gdpr-info.eu/art-30-gdpr/)
