| name | doncheli-data-policy |
| description | Audit and document what personal or sensitive data the project collects, processes, and stores. Activate when user mentions "privacy", "data policy", "what data", "GDPR", "personal data", "data retention", "PII". |
Don Cheli: Data Policy Auditor
Instructions
- Scan the codebase for PII and sensitive data patterns:
- Database models / schemas for fields like email, phone, name, address, IP, location
- API request/response payloads
- Logging statements that may capture sensitive fields
- Third-party integrations that receive user data
- Build a data inventory table: field name, model, purpose, retention, shared with
- Check against common compliance requirements:
- GDPR: lawful basis, right to erasure, data minimization
- CCPA: disclosure, opt-out
- SOC2: access controls, encryption at rest/transit
- Flag violations as [critical | warning | info]
- Generate a draft Privacy Notice section if requested (
--generate-notice)
- Save the audit to
.dc/data-policy-audit-<date>.md
- Never make assumptions about compliance status — only report findings and flag gaps
Output Format
## Data Policy Audit — 2026-03-28
### Data Inventory
| Field | Model | Purpose | Retention | Shared With |
|-----------|-----------|---------------|-----------|----------------|
| email | User | Auth, comms | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog | Security | 90 days | Internal only |
### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING: No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO: No right-to-erasure endpoint found — required for GDPR compliance
### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy
