gdpr-audit-prep

スター23,241

フォーク3,186

更新日2026年6月10日 14:33

/cs:gdpr-audit-prep <scope> — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

ソース

alirezarezvani

alirezarezvani/claude-skills

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

/cs:gdpr-audit-prep — GDPR DPO Forcing Questions

Command: /cs:gdpr-audit-prep <scope>

The GDPR DPO auditor pressure-tests any privacy compliance work. Six Article-cited questions before any internal audit, breach response, DPA investigation, or acquisition due diligence.

When to Run

Before annual internal GDPR audit
Before quarterly Article 30 RoPA refresh
Before launching new high-risk processing (Article 35 DPIA required)
Post-breach (Articles 33-34)
Before DPA investigation response or supervisory authority engagement
During acquisition due diligence (target company privacy posture)
Quarterly during high-volume new-feature shipping

The Six DPO Questions

1. Show me the Article 30 RoPA — with last-updated date.

Most-cited finding area.

Must include all Article 30(1)(a)-(g) elements for controllers
Must include all Article 30(2)(a)-(d) elements for processors
Updated within reasonable time of changes (90 days expected)
Joint controller arrangements documented per Article 26

2. For this processing activity, what's the lawful basis under Article 6?

Article 6 is exclusive — pick ONE basis per purpose.

Six options: consent / contract / legal obligation / vital interests / public task / legitimate interests
Where "legitimate interests": LIA documented
Where "consent": records per Article 7; withdrawal mechanism
Special categories (Article 9) require an Article 9(2) exception

3. For high-risk processing, where's the DPIA per Article 35?

Required for high-risk; sample 3-5 activities.

Article 35(7)(a)-(d) required elements:
- Systematic description of processing
- Necessity + proportionality assessment
- Risks to rights + freedoms
- Measures to address risks
DPO consulted per Article 35(2)
Article 36 prior consultation triggered for residual high risk
For AI systems: integrates with EU AI Act Article 27 FRIA (cross-check with cs-ai-act-compliance)

4. Show me a DSAR from the last 30 days — and the response timing.

Articles 15-22 operational workflow.

Response within 1 month (Article 12(3)); extension up to 2 months for complex requests
Identity verification process documented
Right of access response includes all Article 15 information
Right to erasure (Article 17) workflow covers backups + processors

5. Show me Transfer Impact Assessments for the largest non-EU transfers.

Schrems II discipline.

Adequacy decision OR SCCs (Article 46) OR derogation (Article 49)
TIA per EDPB Recommendations 01/2020 + 02/2020
Supplementary measures where TIA flagged risk
US transfers covered by EU-US Data Privacy Framework adequacy (Jul 2023) — verify list of certified entities

6. Show me the breach log per Article 33(5) — all breaches, not just notifiable ones.

Article 33(5) requires logging ALL breaches.

Internal breach detection mechanism documented
Article 33 DPA notification within 72 hours (where required)
Article 34 data subject notification (where high risk)
Root cause + corrective action via CAPA system
Cross-check with cs-ciso-iso27001 for A.5.24-27 incident management alignment

Workflow

# 1. Compliance posture
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py compliance_state.json

# 2. DPIA for high-risk activities
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/dpia_generator.py processing_activity.json

# 3. DSAR workflow validation
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/data_subject_rights_tracker.py dsar_log.json

# 4. Cross-framework reuse with ISO 27001 + SOC 2 + ISO 42001
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json

Output Format

# GDPR Audit Prep: <scope>
**Date:** YYYY-MM-DD
**Article Citations:** Every finding cites Article + paragraph; no paraphrase.

## The Decision Being Made
[RoPA-refresh | DPIA-required | DSAR-workflow | transfer-risk | breach-followup | DPA-readiness]

## Article 30 RoPA Status
- Last refresh: YYYY-MM-DD
- Required elements present: yes/no per processing activity
- Joint controller arrangements: documented/missing

## Article 6 Lawful Basis Discipline
- Activities reviewed: N
- Legitimate-interests claims without LIA: <list>
- Article 9 special categories with documented exception: yes/no

## Article 35 DPIA Quality
- High-risk activities requiring DPIA: <list>
- DPIAs complete per Article 35(7): pass/fail per activity
- Article 36 prior consultation triggered: <list>

## Data Subject Rights (Articles 12-22)
- DSARs in last 90 days: N
- Average response time: X days (target: ≤ 30)
- Right to erasure backup-processor flow: complete/incomplete

## Article 28 Processor Management
- Processors reviewed: N
- Contracts with all Article 28(3)(a)-(j) clauses: % complete
- Sub-processor flow-down notification mechanism: yes/no

## Schrems II Transfer Status
- Non-EU transfers: <list>
- Mechanism per transfer: adequacy / SCCs / derogation
- TIA on file: yes/no per transfer
- Supplementary measures where needed: <list>

## Article 33-34 Breach Discipline
- Breach log last 12 months: N
- Article 33 notification timing: ≤ 72h ratio
- Article 34 data subject notification (where high risk): on-time ratio

## Cross-Framework Impact
- ISO 27001 Article 32 alignment: clean / gaps
- EU AI Act Article 27 FRIA integration: applicable / not
- SOC 2 Privacy TSC alignment (if scope): clean / gaps

## Verdict
🟢 DPA-READY | 🟡 GAPS-IDENTIFIED | 🔴 NOT-READY

## Top 3 Actions
[3 concrete next steps with owner + Article-cited timeline]

## Outside Counsel Required
[Article-level ambiguities flagged: Schrems II supplementary measure adequacy, EU AI Act ↔ GDPR interaction, sectoral derogation interpretation, novel DPA enforcement]

Routing

/cs:compliance-readiness — for multi-framework view
/cs:iso27001-audit-prep — for Article 32 organizational measures
/cs:ai-act-readiness — for EU AI Act Article 27 FRIA integration
/cs:soc2-audit-prep — for SOC 2 Privacy TSC overlap
/cs:gc-review — for novel-case legal review

Agent: cs-dpo-gdpr
Skill: gdpr-dsgvo-expert
Playbook: gdpr_audit_playbook.md
Adjacent: ../iso27001-audit-prep/, ../ai-act-readiness/, ../soc2-audit-prep/, ../compliance-readiness/

Version: 1.0.0

このリポジトリの他の Skills

同じリポジトリ

meetings

alirezarezvani/claude-skills

Use when someone wants to decide whether a meeting is worth calling, price a meeting in dollars, build a timeboxed agenda with desired outcomes, or turn messy meeting notes into owned action items — or says "should this be a meeting", "/cs:meeting-prep", or "/cs:meeting-actions". Runs a cost gate (ASYNC / NOT-READY / MEET), builds a decision-first agenda, and extracts an owner + due-date checklist that flags every orphan.

2026-07-1723.2k

deep-work

alirezarezvani/claude-skills

Use when someone wants to plan a deep work day, time-block their calendar or task list, budget or cut shallow work, protect focus hours, track deep-work sessions and streaks, run an end-of-day shutdown ritual, or says "/deep-work" or "/time-block". Classifies tasks deep vs shallow, builds an energy-first time-blocked schedule that refuses deep demand past the 4-hour ceiling, batches shallow work into at most two windows, and logs focus sessions against a weekly target.

2026-07-1723.2k

agent-harness

alirezarezvani/claude-skills

Turn any domain folder of skills into a bounded agentic loop: compile a goal into a verifiable task plan, execute tasks with the domain's own tools, verify every task with machine-run checks, retry with caps, escalate to a human when budgets exhaust, and refuse to close until everything is verified or explicitly waived. Use when you want an agent or subagent to pick up a goal and drive it to a verified close across one of this repo's 18 domains ('run this goal through the engineering harness', 'set up an agentic loop for marketing work', 'make the finance domain self-verifying'). NOT for authoring Claude Code Workflow-tool .js scripts (workflow-builder), N-agent tournaments on one task (agenthub), single-file metric optimization (autoresearch-agent), or discovering published loop recipes (loop-library).

2026-07-1723.2k

weekly-review

alirezarezvani/claude-skills

Use when someone wants to run a weekly review, close open loops, audit stalled projects and commitments, get their system back to trusted, restart a lapsed review habit, or says "/cs:weekly-review". Walks David Allen's three-phase loop — GET CLEAR, GET CURRENT, GET CREATIVE — with deterministic scripts that inventory open loops, gate the checklist with named gaps, and score commitment health 0-100.

2026-07-1723.2k

fable-goal

alirezarezvani/claude-skills

Convert a rambling description of a desired outcome into one polished, autonomous /goal prompt ready to paste into a fresh session. Use when the user says "/fable-goal", "turn this into a goal prompt", "write me a fable prompt", "write the prompt that builds X", or rambles about something they want made and asks for the prompt that makes it happen. The output is a single copy-paste prompt, never the build itself. Do NOT use when the user wants the thing built right now in this session — only when they want the PROMPT that will make it happen in a fresh session.

2026-07-1623.2k

skillopt-sleep

alirezarezvani/claude-skills

Use when the user wants their Claude agent to self-improve from past usage, asks about a nightly/offline 'sleep' or 'dream' cycle, memory/skill consolidation, or says things like 'make my agent better the more I use it', 'review my past sessions', 'learn my preferences', 'consolidate what you learned', 'run the sleep cycle', or wants to schedule offline self-optimization. Drives the skillopt_sleep engine: harvest past sessions -> mine recurring tasks -> replay offline -> consolidate validated CLAUDE.md and SKILL.md behind a held-out gate.

2026-07-1123.2k

gdpr-audit-prep

/cs:gdpr-audit-prep — GDPR DPO Forcing Questions

When to Run

The Six DPO Questions

1. Show me the Article 30 RoPA — with last-updated date.

2. For this processing activity, what's the lawful basis under Article 6?

3. For high-risk processing, where's the DPIA per Article 35?

4. Show me a DSAR from the last 30 days — and the response timing.

5. Show me Transfer Impact Assessments for the largest non-EU transfers.

6. Show me the breach log per Article 33(5) — all breaches, not just notifiable ones.

Workflow

Output Format

Routing

Related

/cs:gdpr-audit-prep — GDPR DPO Forcing Questions

When to Run

The Six DPO Questions

1. Show me the Article 30 RoPA — with last-updated date.

2. For this processing activity, what's the lawful basis under Article 6?

3. For high-risk processing, where's the DPIA per Article 35?

4. Show me a DSAR from the last 30 days — and the response timing.

5. Show me Transfer Impact Assessments for the largest non-EU transfers.

6. Show me the breach log per Article 33(5) — all breaches, not just notifiable ones.

Workflow

Output Format

Routing

Related

name	gdpr-audit-prep
description	/cs:gdpr-audit-prep <scope> — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.