Agent skill · data analytics · alirezarezvani
gdpr-audit-prep
Use for /compliance-os:gdpr-audit-prep, or before a GDPR review, post-breach audit or DPA investigation.
Why this skill is useful
Adds 4 executable scripts for GDPR compliance checks and assessments that are not widely available in public documentation.
What it needs
Requires python installed locally. About 4k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
/compliance-os:gdpr-audit-prep — GDPR DPO Forcing Questions Command: /compliance-os:gdpr-audit-prep <scope> The GDPR DPO auditor pressure-tests any privacy compliance work. Six Article-cited questions before any internal audit, breach response, DPA investigation, or acquisition due diligence. When to Run Before annual internal GDPR audit Before quarterly Article 30 RoPA refresh Before launching new high-risk processing (Article 35 DPIA required) Post-breach (Articles 33-34) Before DPA investigation response or supervisory authority engagement During acquisition due diligence (target company privacy posture) Quarterly during high-volume new-feature shipping The Six DPO Questions 1. Show me the Article 30 RoPA — with last-updated date. Most-cited finding area. Must include all Article 30(1)(a)-(g) elements for controllers Must include all Article 30(2)(a)-(d) elements for processors Updated within reasonable time of changes (90 days expected) Joint controller arrangements documented per Article 26 2. For this processing activity, what's the lawful basis under Article 6? Article 6 is exclusive — pick ONE basis per purpose. Six options: consent / contract / legal obligation / vital interests / public task / legitimate interests Where "legitimate interests": LIA documented Where "consent": records per Article 7; withdrawal mechanism Special categories (Article 9) require an Article 9(2) exception 3. For high-risk processing, where's the DPIA per Article 35? Required for high-risk; sample 3-5 activities. Article 35(7)(a)-(d) required elements: Systematic description of processing Necessity + proportionality assessment Risks to rights + freedoms Measures to address risks DPO consulted per Article 35(2) Article 36 prior consultation triggered for residual high risk For AI systems: integrates with EU AI Act Article 27 FRIA (cross-check with cs-ai-act-compliance) 4. Show me a DSAR from the last 30 days — and the response timing. Articles 15-22 operational workflow. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/gdpr-audit-prep--c19965