GDPR Review
Audit a web application's GDPR/RGPD compliance from a developer's perspective, based on the CNIL developer guide (18 fiches) and GDPR articles. Also covers Swiss nLPD principles.
How to Conduct the Audit
1. Explore the Codebase
Before auditing, understand the project:
- Identify the tech stack, framework, and backend language
- Locate forms, user registration, login, and profile pages
- Find cookie/consent management code
- Identify database schemas and data models (what personal data is stored)
- Locate privacy policy, terms of service, and legal pages
- Find third-party integrations (analytics, ads, social SDKs, payment)
- Check for logging, monitoring, and error tracking code
2. Load the Checklist
Read references/checklist.md in this skill's directory for the full list of practices to check.
3. Analyze Each Category
For each category, search the codebase for relevant patterns using Grep, Glob, and Read tools:
- Data collection: forms, input fields, registration flows — what personal data is collected?
- Consent: cookie banners, consent management, opt-in mechanisms
- User rights: account deletion, data export, profile editing, opt-out
- Data storage: database schemas, encryption at rest, hashing of passwords
- Security: HTTPS, CSRF protection, XSS prevention, SQL injection protection, auth mechanisms
- Third parties: analytics scripts, ad SDKs, social widgets, external APIs
- Cookies & trackers: cookie usage, localStorage, sessionStorage, fingerprinting
- Data retention: TTL, purge mechanisms, archival logic
- Logging: what personal data appears in logs, log retention policies
- Transfers: data sent to external services, cross-border considerations
4. Generate the Report
## Audit GDPR/RGPD - [Project Name]
### Score global
X / Y pratiques conformes (Z%)
### Resume
[2-3 sentences summarizing the main findings]
### Resultats par categorie
#### [Category Name]
| # | Pratique | Statut | Commentaire |
|---|----------|--------|-------------|
| 1 | ... | OK/KO/NA | ... |
### Risques critiques
[List any high-risk findings that could lead to sanctions: missing consent, data leaks, etc.]
### Top priorites
[5-10 most impactful improvements, ordered by risk/effort ratio]
### Recommandations detaillees
[For each KO finding, explain what to fix, how, and relevant GDPR article]
Status values:
- OK - Practice is followed
- KO - Practice is not followed (include recommendation + relevant GDPR article)
- NA - Not applicable to this project
- PARTIAL - Partially followed (explain what's missing)
5. Prioritization
When listing recommendations, prioritize by risk:
- Critical - Data breaches, missing consent, sensitive data exposed (sanctions risk)
- High - Missing user rights, no data retention policy, insecure auth
- Medium - Incomplete information notices, cookies without proper management
- Low - Documentation gaps, minor configuration improvements
6. Export the Review Report
Once the audit is complete, save the full analysis as a Markdown document at the root of the audited codebase:
/docs/YYMMDD_gdpr-audit.md
Where YYMMDD is the current date (e.g., 260206 for February 6, 2026). Create the /docs/ directory if it does not exist.
The document must include:
- The complete audit report (as generated in step 4)
- An action plan section at the end, listing all tasks derived from the findings:
- Grouped by priority (Critical, High, Medium, Low)
- Each task broken down into sub-tasks of 2 to 4 hours (assuming AI-assisted development)
- Time estimate for each sub-task
- Total estimated time per priority level
### Plan d'action
#### Critique
- [ ] [Tache] — ~Xh (avec IA)
- [ ] [Sous-tache 1] — ~2h
- [ ] [Sous-tache 2] — ~3h
#### Haute priorite
...
#### Moyenne priorite
...
#### Basse priorite
...
**Total estime : ~Xh**
Important Notes
- This is a technical code audit, not a legal audit. Recommend consulting a DPO/lawyer for full compliance.
- Focus on what is verifiable in the codebase. Flag what needs human/legal review.
- The same principles apply to GDPR (EU), RGPD (FR), and nLPD (CH) — note any differences when relevant.
- Be specific: point to exact files, lines, and code patterns.
- When a practice cannot be verified from code alone (e.g., DPO appointment), mark as "needs verification" rather than OK/KO.
1---2name: gdpr-audit3description: Analyze a web application or codebase for GDPR/RGPD and nLPD (Swiss) compliance. Use when the user asks to audit, check, review, or analyze privacy compliance, data protection, GDPR, RGPD, nLPD, cookie consent, personal data handling, or user rights implementation. Also use when the user mentions "privacy by design", "données personnelles", "CNIL", "protection des données", "consentement", or "droit à l'effacement". Works with HTML, CSS, JavaScript, TypeScript, PHP, and common web frameworks.4---56# GDPR Review78Audit a web application's GDPR/RGPD compliance from a developer's perspective, based on the CNIL developer guide (18 fiches) and GDPR articles. Also covers Swiss nLPD principles.910## How to Conduct the Audit1112### 1. Explore the Codebase1314Before auditing, understand the project:1516- Identify the tech stack, framework, and backend language17- Locate forms, user registration, login, and profile pages18- Find cookie/consent management code19- Identify database schemas and data models (what personal data is stored)20- Locate privacy policy, terms of service, and legal pages21- Find third-party integrations (analytics, ads, social SDKs, payment)22- Check for logging, monitoring, and error tracking code2324### 2. Load the Checklist2526Read `references/checklist.md` in this skill's directory for the full list of practices to check.2728### 3. Analyze Each Category2930For each category, search the codebase for relevant patterns using Grep, Glob, and Read tools:3132- **Data collection**: forms, input fields, registration flows — what personal data is collected?33- **Consent**: cookie banners, consent management, opt-in mechanisms34- **User rights**: account deletion, data export, profile editing, opt-out35- **Data storage**: database schemas, encryption at rest, hashing of passwords36- **Security**: HTTPS, CSRF protection, XSS prevention, SQL injection protection, auth mechanisms37- **Third parties**: analytics scripts, ad SDKs, social widgets, external APIs38- **Cookies & trackers**: cookie usage, localStorage, sessionStorage, fingerprinting39- **Data retention**: TTL, purge mechanisms, archival logic40- **Logging**: what personal data appears in logs, log retention policies41- **Transfers**: data sent to external services, cross-border considerations4243### 4. Generate the Report4445```46## Audit GDPR/RGPD - [Project Name]4748### Score global49X / Y pratiques conformes (Z%)5051### Resume52[2-3 sentences summarizing the main findings]5354### Resultats par categorie5556#### [Category Name]57| # | Pratique | Statut | Commentaire |58|---|----------|--------|-------------|59| 1 | ... | OK/KO/NA | ... |6061### Risques critiques62[List any high-risk findings that could lead to sanctions: missing consent, data leaks, etc.]6364### Top priorites65[5-10 most impactful improvements, ordered by risk/effort ratio]6667### Recommandations detaillees68[For each KO finding, explain what to fix, how, and relevant GDPR article]69```7071**Status values:**72- **OK** - Practice is followed73- **KO** - Practice is not followed (include recommendation + relevant GDPR article)74- **NA** - Not applicable to this project75- **PARTIAL** - Partially followed (explain what's missing)7677### 5. Prioritization7879When listing recommendations, prioritize by risk:80811. **Critical** - Data breaches, missing consent, sensitive data exposed (sanctions risk)822. **High** - Missing user rights, no data retention policy, insecure auth833. **Medium** - Incomplete information notices, cookies without proper management844. **Low** - Documentation gaps, minor configuration improvements8586### 6. Export the Review Report8788Once the audit is complete, save the full analysis as a Markdown document at the root of the audited codebase:8990```91/docs/YYMMDD_gdpr-audit.md92```9394Where `YYMMDD` is the current date (e.g., `260206` for February 6, 2026). Create the `/docs/` directory if it does not exist.9596The document must include:97981. The complete audit report (as generated in step 4)992. An **action plan** section at the end, listing all tasks derived from the findings:100 - Grouped by priority (Critical, High, Medium, Low)101 - Each task broken down into sub-tasks of **2 to 4 hours** (assuming AI-assisted development)102 - Time estimate for each sub-task103 - Total estimated time per priority level104105```106### Plan d'action107108#### Critique109- [ ] [Tache] — ~Xh (avec IA)110 - [ ] [Sous-tache 1] — ~2h111 - [ ] [Sous-tache 2] — ~3h112113#### Haute priorite114...115116#### Moyenne priorite117...118119#### Basse priorite120...121122**Total estime : ~Xh**123```124125## Important Notes126127- This is a **technical code audit**, not a legal audit. Recommend consulting a DPO/lawyer for full compliance.128- Focus on what is verifiable in the codebase. Flag what needs human/legal review.129- The same principles apply to GDPR (EU), RGPD (FR), and nLPD (CH) — note any differences when relevant.130- Be specific: point to exact files, lines, and code patterns.131- When a practice cannot be verified from code alone (e.g., DPO appointment), mark as "needs verification" rather than OK/KO.
benjaminhaeberli