Agent skill · operations · borghei
gdpr-audit-prep
GDPR audit-prep playbook: sprint to prepare for a supervisory authority inquiry, DPA audit, or internal review. Use when an audit is scheduled, when readiness gaps surface, or when ROPA (Records of Processing Activities) needs completion.
Why this skill is useful
Provides specific procedural guidance and scripts for GDPR audit preparation that the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-07-21. 462 stars on the source repository.
What this skill does
GDPR Audit Prep Operational playbook for GDPR audit preparation — whether triggered by a Data Protection Authority (DPA) inquiry, customer-side DPA review, internal compliance audit, or annual self-assessment. When to use this skill vs. gdpr-dsgvo-expert: This skill: audit imminent (4-12 weeks); need execution sprint gdpr-dsgvo-expert: building GDPR program; designing DPIA process; multi-quarter --- When to use this skill Situation Skill applies ----------- --------------- Supervisory authority inquiry received Yes — start immediately; engage DPO Customer DPA audit / questionnaire Yes — scripts/gdprreadinessscore.py first Annual internal GDPR audit Yes — standard sprint ROPA needs rapid update Yes — scripts/ropacompletenesschecker.py New high-risk processing → DPIA needed Use ra-qm-team/gdpr-dsgvo-expert for DPIA design --- The audit-prep sprint at a glance 4-week sprint (well-prepared org, periodic review) 8-week sprint (gaps remaining) 12-week sprint (DPA inquiry response) See references/gdpr-pre-audit-checklist.md for the full pre-audit punch list and references/dpo-engagement-playbook.md for DPO-coordinated audit response. --- Critical GDPR audit areas 1. ROPA (Records of Processing Activities, Article 30) Every processing activity documented: Purpose of processing Categories of data subjects + data types Recipients (internal + external) International transfers (and lawful basis) Retention periods Security measures Lawful basis (consent, contract, legitimate interest, etc.) DPIA reference (if high-risk) Audit gap: ROPA incomplete, stale, or missing for processing activities surfaced during audit. 2. Privacy Notices (Article 13/14) Privacy notice published + current Contains all required information (data controller, purposes, lawful basis, retention, rights, complaints contact, etc.) Easily accessible (no dark patterns) Translated for EU member states (where required) 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills borghei/gdpr-audit-prep