GDPR DPO Forcing Questions
This skill runs a GDPR audit preparation interrogation using six Article-cited forcing questions. It pressure-tests privacy compliance work before internal audits, breach responses, DPA investigations, or due diligence, producing a structured report with verdict and actions.
✨ What it does
- Checks Article 30 RoPA completeness and recency
- Validates lawful basis under Article 6 and special categories under Article 9
- Assesses DPIA quality per Article 35 and Article 36 prior consultation
- Reviews DSAR workflows and response timing per Articles 12-22
- Evaluates Transfer Impact Assessments for non-EU transfers (Schrems II)
- Audits breach logging and notification per Articles 33-34
🎯 When to use it
- Before annual internal GDPR review or quarterly Article 30 RoPA refresh
- Post-breach internal audit or DPA investigation readiness
- Before launching new high-risk processing requiring a DPIA
- During acquisition due diligence on target company privacy posture
🚀 How to use
Trigger: /cs:gdpr-audit-prep
Trigger with the slash command /cs:gdpr-audit-prep <scope> where scope is the area to audit (e.g., 'annual review', 'post-breach', 'DPA investigation'). The skill expects access to compliance state files, processing activity records, DSAR logs, and breach logs. Example prompts:
/cs:gdpr-audit-prep annual-review
/cs:gdpr-audit-prep post-breach
📄 Output: A structured GDPR audit prep report with Article citations, verdict (DPA-READY/GAPS-IDENTIFIED/NOT-READY), and top 3 actions.
📦 Add this skill to Claude Code
# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills
# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/compliance-os/skills/gdpr-audit-prep .claude/skills/gdpr-audit-prepSkill source: compliance-os/skills/gdpr-audit-prep/SKILL.md
⚠️ Good to know
Requires up-to-date compliance state data and access to relevant logs; does not provide legal advice and may need outside counsel for ambiguous cases.
❓ FAQ
What are the six forcing questions?
The six questions cover Article 30 RoPA, Article 6 lawful basis, Article 35 DPIA, DSARs (Articles 15-22), Transfer Impact Assessments (Schrems II), and breach log per Article 33(5).
How often should this skill be run?
It is recommended before annual internal GDPR audit, quarterly RoPA refresh, before high-risk processing, post-breach, before DPA investigation, and during due diligence.
Does it cover processor management?
Yes, the output includes an Article 28 Processor Management section checking contracts and sub-processor flow-down.
🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.