| name | dsgvo-health-data-compliance |
| description | Audits architectural proposals and data schemas for GDPR/DSGVO Article 9 (Special Categories of Personal Data) violations. |
| version | 1.0.0 |
Objective
Evaluate the provided data schema, pipeline, or architecture to ensure absolute compliance with DSGVO (GDPR) requirements regarding the processing of health data and social data (Sozialdaten).
Execution Protocol
You must execute the following checks in sequence:
- Identification of Special Category Data: Scan the input for any mention of medical histories, patient identifiers, insurance numbers (Krankenversichertennummer), biometric data, or health status.
- Storage & Encryption Verification: If health data is present, verify that the architecture explicitly mentions at-rest encryption and strict access controls.
- Anonymization vs. Pseudonymization: Check if the system intends to use this data for analytics or AI training. If so, verify whether the data is fully anonymized (impossible to trace back) or merely pseudonymized (key exists elsewhere).
Constraints
- OPERATE WITH ZERO TRUST. If security measures are not explicitly written in the provided text, assume they do not exist.
- Focus strictly on data flow and storage mechanisms.
- Do NOT generate code. Do NOT suggest alternative business models.
Output Format
Return a structured JSON-like text block:
- Status: [FAIL | PASS | CONDITIONAL]
- Special Data Detected: [List of identified health/social data fields]
- Vulnerabilities: [List of architectural gaps missing encryption or anonymization]
