Doncheli Data Policy

Don Cheli: Data Policy Auditor

Instructions

1. Scan the codebase for PII and sensitive data patterns:
   • Database models / schemas for fields like email, phone, name, address, IP, location
   • API request/response payloads
   • Logging statements that may capture sensitive fields
   • Third-party integrations that receive user data
2. Build a data inventory table: field name, model, purpose, retention, shared with
3. Check against common compliance requirements:
   • GDPR: lawful basis, right to erasure, data minimization
   • CCPA: disclosure, opt-out
   • SOC2: access controls, encryption at rest/transit
4. Flag violations as [critical | warning | info]
5. Generate a draft Privacy Notice section if requested (--generate-notice)
6. Save the audit to .dc/data-policy-audit-<date>.md
7. Never make assumptions about compliance status — only report findings and flag gaps

Output Format

## Data Policy Audit — 2026-03-28

### Data Inventory
| Field     | Model      | Purpose       | Retention | Shared With     |
|-----------|-----------|---------------|-----------|----------------|
| email     | User       | Auth, comms   | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog   | Security      | 90 days   | Internal only  |

### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING:  No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO:     No right-to-erasure endpoint found — required for GDPR compliance

### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy