Agent skill

Gdpr Audit Prep

by alirezarezvani in alirezarezvani/claude-skills

/cs:gdpr-audit-prep <scope — GDPR audit 6-question Article-cited forcing interrogation.

MITAuto-check passedLegal & Compliance

Install Gdpr Audit Prep

skills CLI
$ npx skills add alirezarezvani/claude-skills --skill gdpr-audit-prep -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install alirezarezvani/claude-skills gdpr-audit-prep --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/alirezarezvani/claude-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/compliance-os/skills/gdpr-audit-prep .claude/skills/gdpr-audit-prep && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
gdpr-audit-prep
GitHub stars
28k
Token cost
~1.7k tokens
SKILL.md length
459 words
Files
1
Skills in repo
342
Repo updated
First seen
Licence
MIT

At a glance

/cs:gdpr-audit-prep <scope — GDPR audit 6-question Article-cited forcing interrogation.

  • Works in 6 steps: Show me the Article 30 RoPA — with… → For this processing activity, what's the… → For high-risk processing, where's the… → …
  • Tasks that involve Privacy and GDPR
  • SKILL.md covers When to Run, The Six DPO Questions, Workflow and Output Format, plus 2 more sections
  • Calls python

What it does

Gdpr Audit Prep is an agent skill from alirezarezvani/claude-skills. /cs:gdpr-audit-prep <scope — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.

Its SKILL.md is about 1.7k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Legal & Compliance, covering Privacy and GDPR. The repository describes itself as: 380 Claude Code skills & agent skills & plugins (30+ Agents, 70+ custom commands, 380+ skills, customizable references, scripts)for Claude Code, Codex, Gemini CLI, Cursor, and 8… The licence is MIT.

When your agent uses it

  • Tasks that involve Privacy and GDPR

Example prompts

  • “/gdpr-audit-prep”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Show me the Article 30 RoPA — with last-updated date.
  2. For this processing activity, what's the lawful basis under Article 6?
  3. For high-risk processing, where's the DPIA per Article 35?
  4. Show me a DSAR from the last 30 days — and the response timing.
  5. Show me Transfer Impact Assessments for the largest non-EU transfers.
  6. Show me the breach log per Article 33(5) — all breaches, not just notifiable ones.

What it can do on your machine

Read from SKILL.md and the folder at commit 19392f7. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Gdpr Audit Prep loads about 1.7k tokens when it runs. Until then it costs about 58 tokens; SKILL.md has 459 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~58
When it runs · the whole SKILL.md, loaded when a task matches
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from alirezarezvani/claude-skills at commit 19392f7, republished under its MIT licence (© alirezarezvani). 459 words, ~1,692 tokens.

Download SKILL.mdSave it as .claude/skills/gdpr-audit-prep/SKILL.md (or your agent's skills folder).
name
gdpr-audit-prep
description
/cs:gdpr-audit-prep <scope> — GDPR audit 6-question Article-cited forcing interrogation. Use before annual internal GDPR review, post-breach internal audit, DPA investigation readiness, or acquisition due diligence.

/cs:gdpr-audit-prep — GDPR DPO Forcing Questions

Command: /cs:gdpr-audit-prep <scope>

The GDPR DPO auditor pressure-tests any privacy compliance work. Six Article-cited questions before any internal audit, breach response, DPA investigation, or acquisition due diligence.

When to Run

  • Before annual internal GDPR audit
  • Before quarterly Article 30 RoPA refresh
  • Before launching new high-risk processing (Article 35 DPIA required)
  • Post-breach (Articles 33-34)
  • Before DPA investigation response or supervisory authority engagement
  • During acquisition due diligence (target company privacy posture)
  • Quarterly during high-volume new-feature shipping

The Six DPO Questions

1. Show me the Article 30 RoPA — with last-updated date.

Most-cited finding area.

  • Must include all Article 30(1)(a)-(g) elements for controllers
  • Must include all Article 30(2)(a)-(d) elements for processors
  • Updated within reasonable time of changes (90 days expected)
  • Joint controller arrangements documented per Article 26
2. For this processing activity, what's the lawful basis under Article 6?

Article 6 is exclusive — pick ONE basis per purpose.

  • Six options: consent / contract / legal obligation / vital interests / public task / legitimate interests
  • Where "legitimate interests": LIA documented
  • Where "consent": records per Article 7; withdrawal mechanism
  • Special categories (Article 9) require an Article 9(2) exception
3. For high-risk processing, where's the DPIA per Article 35?

Required for high-risk; sample 3-5 activities.

  • Article 35(7)(a)-(d) required elements:
    • Systematic description of processing
    • Necessity + proportionality assessment
    • Risks to rights + freedoms
    • Measures to address risks
  • DPO consulted per Article 35(2)
  • Article 36 prior consultation triggered for residual high risk
  • For AI systems: integrates with EU AI Act Article 27 FRIA (cross-check with cs-ai-act-compliance)
4. Show me a DSAR from the last 30 days — and the response timing.

Articles 15-22 operational workflow.

  • Response within 1 month (Article 12(3)); extension up to 2 months for complex requests
  • Identity verification process documented
  • Right of access response includes all Article 15 information
  • Right to erasure (Article 17) workflow covers backups + processors
Show full SKILL.md (159 more words)Show less
5. Show me Transfer Impact Assessments for the largest non-EU transfers.

Schrems II discipline.

  • Adequacy decision OR SCCs (Article 46) OR derogation (Article 49)
  • TIA per EDPB Recommendations 01/2020 + 02/2020
  • Supplementary measures where TIA flagged risk
  • US transfers covered by EU-US Data Privacy Framework adequacy (Jul 2023) — verify list of certified entities
6. Show me the breach log per Article 33(5) — all breaches, not just notifiable ones.

Article 33(5) requires logging ALL breaches.

  • Internal breach detection mechanism documented
  • Article 33 DPA notification within 72 hours (where required)
  • Article 34 data subject notification (where high risk)
  • Root cause + corrective action via CAPA system
  • Cross-check with cs-ciso-iso27001 for A.5.24-27 incident management alignment

Workflow

bash
# 1. Compliance posture
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/gdpr_compliance_checker.py compliance_state.json

# 2. DPIA for high-risk activities
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/dpia_generator.py processing_activity.json

# 3. DSAR workflow validation
python ra-qm-team/skills/gdpr-dsgvo-expert/scripts/data_subject_rights_tracker.py dsar_log.json

# 4. Cross-framework reuse with ISO 27001 + SOC 2 + ISO 42001
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json

Output Format

markdown
# GDPR Audit Prep: <scope>
**Date:** YYYY-MM-DD
**Article Citations:** Every finding cites Article + paragraph; no paraphrase.

## The Decision Being Made
[RoPA-refresh | DPIA-required | DSAR-workflow | transfer-risk | breach-followup | DPA-readiness]

## Article 30 RoPA Status
- Last refresh: YYYY-MM-DD
- Required elements present: yes/no per processing activity
- Joint controller arrangements: documented/missing

## Article 6 Lawful Basis Discipline
- Activities reviewed: N
- Legitimate-interests claims without LIA: <list>
- Article 9 special categories with documented exception: yes/no

## Article 35 DPIA Quality
- High-risk activities requiring DPIA: <list>
- DPIAs complete per Article 35(7): pass/fail per activity
- Article 36 prior consultation triggered: <list>

## Data Subject Rights (Articles 12-22)
- DSARs in last 90 days: N
- Average response time: X days (target: ≤ 30)
- Right to erasure backup-processor flow: complete/incomplete

## Article 28 Processor Management
- Processors reviewed: N
- Contracts with all Article 28(3)(a)-(j) clauses: % complete
- Sub-processor flow-down notification mechanism: yes/no

## Schrems II Transfer Status
- Non-EU transfers: <list>
- Mechanism per transfer: adequacy / SCCs / derogation
- TIA on file: yes/no per transfer
- Supplementary measures where needed: <list>

## Article 33-34 Breach Discipline
- Breach log last 12 months: N
- Article 33 notification timing: ≤ 72h ratio
- Article 34 data subject notification (where high risk): on-time ratio

## Cross-Framework Impact
- ISO 27001 Article 32 alignment: clean / gaps
- EU AI Act Article 27 FRIA integration: applicable / not
- SOC 2 Privacy TSC alignment (if scope): clean / gaps

## Verdict
🟢 DPA-READY | 🟡 GAPS-IDENTIFIED | 🔴 NOT-READY

## Top 3 Actions
[3 concrete next steps with owner + Article-cited timeline]

## Outside Counsel Required
[Article-level ambiguities flagged: Schrems II supplementary measure adequacy, EU AI Act ↔ GDPR interaction, sectoral derogation interpretation, novel DPA enforcement]

Routing

  • /cs:compliance-readiness — for multi-framework view
  • /cs:iso27001-audit-prep — for Article 32 organizational measures
  • /cs:ai-act-readiness — for EU AI Act Article 27 FRIA integration
  • /cs:soc2-audit-prep — for SOC 2 Privacy TSC overlap
  • /cs:gc-review — for novel-case legal review

Version: 1.0.0

© alirezarezvani, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in compliance-os/skills/gdpr-audit-prep of alirezarezvani/claude-skills.

Open the folder on GitHubat commit 19392f7

Compare with similar skills

Gdpr Audit Prep next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Gdpr Audit Prep compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Gdpr Audit Prep this skillalirezarezvani/claude-skills28k—~1.7kAutomated safety check: PassMIT
C15tc15t/c15t1.9k1 repos~1.6kAutomated safety check: PassApache-2.0
HIPAA Safe Harbor Coverage Auditmaziyarpanahi/openmed5.5k—~1.7kAutomated safety check: PassApache-2.0
Korean Privacy Termskimlawtech/korean-privacy-terms586—~2.9kAutomated safety check: PassApache-2.0
Gdpr ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance9421 repos~3.9kAutomated safety check: PassMIT
Hipaa ComplianceSushegaad/Claude-Skills-Governance-Risk-and-Compliance9421 repos~2.3kAutomated safety check: PassMIT

Similar skills

  • C15t

    c15t/c15t

    Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.

    1.9k GitHub starsUsed in 1 repo~1.6k tokens
    Legal & ComplianceAuto-check passed
  • Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.

    5.5k GitHub stars~1.7k tokensUpdated yesterday
    Legal & ComplianceAuto-check passed
  • Korean Privacy Terms

    kimlawtech/korean-privacy-terms

    처리방침·이용약관 자동 생성 스킬 패키지 (v4.0). An agent skill from kimlawtech/korean-privacy-terms.

    586 GitHub stars~2.9k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed
  • Gdpr Compliance

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing…

    942 GitHub starsUsed in 1 repo~3.9k tokens
    Legal & ComplianceAuto-check passed
  • Hipaa Compliance

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert HIPAA compliance assistant for healthcare and software contexts.

    942 GitHub starsUsed in 1 repo~2.3k tokens
    Legal & ComplianceAuto-check passed
  • Pii Contract Analyze

    gregmos/PII-Shield

    Universal legal document processor with PII anonymization. An agent skill from gregmos/PII-Shield.

    149 GitHub stars~8.9k tokensUpdated 3 mo ago
    Legal & ComplianceAuto-check: notes

More from alirezarezvani/claude-skills

All 342 skills in this repo
  • Agile Product Owner

    alirezarezvani/claude-skills

    Writes INVEST-checked user stories with acceptance criteria, splits epics, plans sprints from velocity and ranks the backlog with a weighted score.

    28k GitHub starsUsed in 3 repos~3.2k tokens
    Auto-check passed
  • Product Strategist

    alirezarezvani/claude-skills

    OKR cascade toolkit for product leaders: generates aligned company-to-team OKRs from five strategy types and scores how well they line up.

    28k GitHub starsUsed in 2 repos~1.8k tokens
    Auto-check passed
  • App Store Optimization

    alirezarezvani/claude-skills

    App Store Optimization (ASO) toolkit for researching keywords, analyzing competitor rankings, generating metadata suggestions, and improving app visibility on Apple App Store and Google Play Store.

    28k GitHub starsUsed in 1 repo~4.2k tokens
    Auto-check passed
  • AWS Solution Architect

    alirezarezvani/claude-skills

    Design AWS architectures for startups using serverless patterns and IaC templates.

    28k GitHub starsUsed in 1 repo~2.5k tokens
    Auto-check passed
  • Campaign Analytics

    alirezarezvani/claude-skills

    Calculates attribution, funnel and ROI figures for marketing campaigns with three Python scripts that need only the standard library.

    28k GitHub starsUsed in 1 repo~2.1k tokens
    Auto-check passed
  • Code to PRD

    alirezarezvani/claude-skills

    Reverse-engineers a frontend, backend or fullstack codebase into a product requirements document with per-page docs, an enum dictionary and an API inventory.

    28k GitHub starsUsed in 1 repo~4.9k tokens
    Auto-check passed

Questions about Gdpr Audit Prep

What does Gdpr Audit Prep do?

/cs:gdpr-audit-prep <scope — GDPR audit 6-question Article-cited forcing interrogation. Gdpr Audit Prep is an agent skill from alirezarezvani/claude-skills. /cs:gdpr-audit-prep <scope — GDPR audit 6-question Article-cited forcing interrogation.

When should I use Gdpr Audit Prep?

Gdpr Audit Prep fits situations like: tasks that involve Privacy and GDPR.

How do I install Gdpr Audit Prep in Claude Code?

Run `npx skills add alirezarezvani/claude-skills --skill gdpr-audit-prep -a claude-code`. Or copy the skill folder (compliance-os/skills/gdpr-audit-prep in alirezarezvani/claude-skills) into .claude/skills/gdpr-audit-prep in your project. Claude Code loads it when a task matches its description.

How do I install Gdpr Audit Prep in Codex?

Run `npx skills add alirezarezvani/claude-skills --skill gdpr-audit-prep -a codex`. Or copy the skill folder (compliance-os/skills/gdpr-audit-prep in alirezarezvani/claude-skills) into .agents/skills/gdpr-audit-prep in your project. Codex loads it when a task matches its description.

Can I use Gdpr Audit Prep in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add alirezarezvani/claude-skills --skill gdpr-audit-prep -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/gdpr-audit-prep, .gemini/skills/gdpr-audit-prep, .github/skills/gdpr-audit-prep and .opencode/skills/gdpr-audit-prep in your project.

What does Gdpr Audit Prep need to run?

Going by SKILL.md and its folder, Gdpr Audit Prep needs the command-line tools its instructions call (python). Our summary lists: Python 3.

Does Gdpr Audit Prep access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Gdpr Audit Prep safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Gdpr Audit Prep use?

Gdpr Audit Prep is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Gdpr Audit Prep use?

About 1.7k tokens (SKILL.md is roughly 6.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Gdpr Audit Prep?

Skills that share tags, products or a category with Gdpr Audit Prep: C15t (c15t/c15t, 1.9k stars), HIPAA Safe Harbor Coverage Audit (maziyarpanahi/openmed, 5.5k stars), Korean Privacy Terms (kimlawtech/korean-privacy-terms, 586 stars) and Gdpr Compliance (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 942 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Gdpr Audit Prep?

alirezarezvani (a GitHub user) maintains it in alirezarezvani/claude-skills, which has 27,829 GitHub stars. The repository holds 342 skills in this directory. The repository was last updated on August 30, 2026.

Source: alirezarezvani/claude-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.