Autonomous GDPR compliance auditor that scans a codebase to identify PII collection, storage, and sharing, then produces an article-by-article gap analysis, a pre-filled Data Processing Agreement (DPA), and a ROPA (Record of Processing Activities) starter kit — all exported as downloadable files (.docx recommended). Use this skill whenever the user mentions GDPR, data privacy audit, DPA, ROPA, EU compliance, PII scan, data protection, ICO, CNIL, or asks whether their codebase or product is compliant with data protection law. Trigger even for casual phrasings like "are we GDPR compliant?", "I need to check our data privacy", or "help me get audit-ready." The skill runs autonomously — it reads the codebase, researches third-party processors, and produces final deliverables without the user needing to provide structured input.
Proactive PII add-on — augments the main response with PII guidance. Auto-trigger on any form, schema, migration, model, API route, GraphQL resolver, auth flow, or data design discussion. Also fires on: middleware, webhooks, workers, seed/fixture/factory files, delete/export/purge/anonymize functions, cron jobs, HTTP clients, controllers, services, resolvers. Trigger phrases: "build a form", "collect X data", "what fields should I include", "how should I design the schema", "POC / lead / contact / user / customer information", "store / save / persist X", "sign up / login / auth / registration", "share thoughts on how to build". Trigger on field names: email, phone, name, dob, ssn, card, cvv, password, token, secret, api_key, health, biometric, ip_address, salary, session, device_id, notes, metadata (on user-facing models).