| name | compliance-policy-auditor |
| title | Compliance Policy Auditor |
| description | Audit corporate policies or data-handling descriptions against regulatory frameworks (GDPR, SOC2, HIPAA). Use when users need to identify compliance gaps or risk levels in technical procedures. |
| author | CreativeActtech |
| author_url | https://github.com/CreativeActtech/llm-skills/tree/main/skills/example-skill/compliance-policy-analyzer |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
| tags | ["legal","compliance","audit","security","risk"] |
Compliance Policy Auditor
Systematically reviews technical or procedural documentation to identify
alignment or deviations from major regulatory frameworks.
🎯 When to Use
- User provides a "Privacy Policy" or "Data Retention Plan" for review.
- User asks: "Is this process SOC2 compliant?" or "What GDPR risks exist here?"
- Do NOT use for providing binding legal advice or drafting contracts.
- Do NOT use for auditing physical security (cams, locks) unless documented.
🧠 Core Workflow
Step 1 — Scope & Framework Selection
IF user specifies a framework (GDPR/SOC2/HIPAA/ISO27001), prioritize its rules;
ELSE, apply General Data Protection principles.
Step 2 — Data Mapping
Identify PII (Personally Identifiable Information), PHI (Protected Health
Information), or PCI data mentioned in the text.
Step 3 — Gap Analysis
- Data Minimization — Check if only necessary data is collected.
- Access Control — Audit description of "Who has access" (RBAC).
- Security Measures — Identify encryption, hashing, and log requirements.
Step 4 — Risk Scoring
Assign Severity (Critical/Major/Minor) to gaps based on regulatory fine potential.
Step 5 — Return Output
Provide a structured JSON audit report.
📋 Output Format
{
"frameworks_evaluated": ["GDPR", "SOC2"],
"pii_detected": ["email", "IP address"],
"findings": [
{
"severity": "critical"
