| name | 06-compliance-governance-lgpd |
| description | Use when auditing privacy, LGPD-oriented governance, consent, terms, privacy policies, retention, deletion, data subject rights, subprocessors, international transfers, and audit evidence. Defensive compliance guidance, not legal advice. |
Compliance and Governance — LGPD-Oriented
Mission
Map and reduce privacy/legal risk in systems that collect, store, process, or share personal data. This skill is practical engineering governance, not legal advice. For regulated or high-risk cases, recommend review by qualified counsel.
Use when
- The system collects names, email, phone, CPF, address, IP, cookies, messages, payment metadata, health/fitness data, or any data that can identify a person.
- The user asks about LGPD, privacy policy, terms, consent, deletion, data export, retention, subprocessors, OpenAI data sharing, or audit evidence.
Workflow
1. Build a personal data inventory
Search:
rg -n 'name|email|phone|cpf|document|address|birth|gender|ip|cookie|session|message|prompt|payment|stripe|health|fitness|medical|location|avatar|profile' app pages src server db prisma supabase docs 2>/dev/null
Create a table:
| Data field | Where collected | Where stored | Purpose | Legal basis candidate | Shared with | Retention |
|---|
Apply minimization: if the business purpose does not require the field, recommend removing it.
2. Identify sensitive data
Sensitive categories need stricter handling. Flag any data related to health, biometrics, children, political opinions, religion, sexuality, ethnicity, union membership, or other high-risk categories.
3. Review consent and legal basis
Search:
rg -n 'consent|terms|privacy|policy|cookie|accept|agree|newsletter|marketing|opt[-_ ]?in|lgpd|legal basis' app pages src docs 2>/dev/null
Required:
- Consent is not pre-checked.
- Consent is specific, informed, and recorded when used.
- Terms and privacy policy links are visible near collection points.
- Marketing consent is separate from service necessity.
- Cookie/analytics consent exists when tracking beyond strictly necessary cookies.
4. Review privacy policy and terms
Look for documents/pages that explain:
- what data is collected;
- why it is collected;
- where it is stored;
- who receives it;
- how long it is retained;
- how users request access/correction/deletion/portability;
- contact channel for privacy requests;
- international transfers and subprocessors.
5. Review data subject rights implementation
Search:
rg -n 'delete account|export data|download data|privacy request|data request|erase|deletion|portability|rectification|account deletion' app pages src server docs 2>/dev/null
Required capabilities:
- access/export;
- correction;
- deletion/anonymization;
- consent revocation;
- response process and owner;
- ticket/log of requests.
6. Review retention and deletion
Search:
rg -n 'retention|expires_at|deleted_at|soft delete|anonymize|purge|cron|cleanup|archive' app pages src server db prisma supabase docs 2>/dev/null
Required:
- retention periods defined;
- inactive/obsolete data cleanup;
- deletion propagates to related tables and third-party providers when required;
- backups are handled according to documented retention constraints.
7. Review third parties and international transfers
Search:
rg -n 'openai|anthropic|stripe|vercel|supabase|sendgrid|resend|analytics|google|meta|hotjar|sentry|posthog|segment|subprocessor|DPA|data processing' package.json app pages src docs .env.example 2>/dev/null
For each third party, record:
- what data is sent;
- purpose;
- region/country when known;
- DPA status;
- user disclosure status;
- opt-out/consent requirements.
8. Audit evidence
Search or recommend tables/artifacts:
consent_records,terms_acceptance,audit_log,- Records of Processing Activities (ROPA) or simplified processing inventory,
- privacy request log.
Output contract
# Compliance and Governance Report
Legal note: This is engineering governance support, not legal advice.
## Data inventory
| Field | Purpose | Storage | Sharing | Risk | Recommendation |
|---|---|---|---|---|---|
## Consent and transparency review
## Data subject rights review
## Retention/deletion review
## Third-party/subprocessor review
## Audit evidence gaps
## Findings
| Severity | Evidence | Risk | Fix | Verification |
|---|---|---|---|---|
Stop criteria
Stop and escalate for high-risk sensitive data, children’s data, large-scale personal data processing, breach response, legal notices, or production incidents involving personal data.
