# Auditing Privacy Compliance > - Skill: `majiayu000/auditing-privacy-compliance` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds add majiayu000/auditing-privacy-compliance` - Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/auditing-privacy-compliance/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: majiayu000 (https://skillmd.com/u/majiayu000) - Updated: 2026-09-09 - Page: https://skillmd.com/skills/majiayu000/auditing-privacy-compliance --- --- name: auditing-privacy-compliance description: >- Audit organizational privacy compliance against GDPR, CCPA/CPRA, and HIPAA frameworks by mapping data flows, assessing lawful bases, evaluating data subject rights fulfillment, and producing Data Protection Impact Assessments. domain: cybersecurity subdomain: compliance-audit tags: - gdpr - ccpa - hipaa - dpia - privacy-audit - data-protection version: "1.0" author: defconxt license: AGPL-3.0 metadata: frameworks: ["GDPR", "CCPA", "CPRA", "HIPAA"] tools: ["python3", "jq", "openssl"] mitre-attack: [] --- ## Overview Privacy compliance auditing evaluates how an organization collects, processes, stores, and shares personal data against applicable regulations. This technique covers GDPR (EU), CCPA/CPRA (California), and HIPAA (US healthcare) — mapping data flows, verifying lawful processing bases, assessing data subject rights implementation, and producing DPIAs for high-risk processing. ## Prerequisites - Tools: `python3`, `jq`, `openssl` - Data inventory / records of processing activities (RoPA) - Privacy policy and consent management documentation - Access to data processing system configurations - Legal basis documentation for each processing activity ## Key Concepts - **RoPA**: Record of Processing Activities — GDPR Art. 30 requirement - **DPIA**: Data Protection Impact Assessment — required for high-risk processing - **Lawful basis**: Legal justification for processing (consent, contract, etc.) - **Data subject rights**: Access, rectification, erasure, portability, objection - **Data minimization**: Collect only what is necessary for stated purpose - **Privacy by Design**: GDPR Art. 25 — embed privacy into system design ## Workflow ### Step 1: Map Data Processing Activities ```bash # Discover databases and data stores containing personal data # Scan for PII patterns in database schemas python3 -c " import json pii_columns = [ 'email', 'phone', 'ssn', 'social_security', 'date_of_birth', 'address', 'credit_card', 'ip_address', 'first_name', 'last_name', 'passport', 'driver_license', 'medical_record', 'diagnosis', ] # Simulated schema scan — replace with actual DB introspection schemas = { 'users': ['id', 'email', 'first_name', 'last_name', 'phone', 'address'], 'orders': ['id', 'user_id', 'credit_card', 'billing_address'], 'health_records': ['id', 'patient_id', 'diagnosis', 'ssn'], } findings = [] for table, columns in schemas.items(): pii_found = [c for c in columns if any(p in c for p in pii_columns)] if pii_found: findings.append({'table': table, 'pii_columns': pii_found}) print(json.dumps(findings, indent=2)) " ``` ### Step 2: Assess GDPR Compliance (Art. 5-7, 12-23, 25, 30, 35) ```bash # GDPR compliance checklist assessment cat << 'EOF' GDPR Audit Checklist: [ ] Art. 5 — Data processing principles documented [ ] Art. 6 — Lawful basis identified for each processing activity [ ] Art. 7 — Consent freely given, specific, informed, unambiguous [ ] Art. 13 — Privacy notice provided at collection point [ ] Art. 15 — Subject access request (SAR) process implemented [ ] Art. 17 — Right to erasure / right to be forgotten process [ ] Art. 20 — Data portability mechanism available [ ] Art. 25 — Privacy by Design and by Default implemented [ ] Art. 30 — Records of Processing Activities maintained [ ] Art. 33 — Breach notification process (72-hour requirement) [ ] Art. 35 — DPIA conducted for high-risk processing [ ] Art. 37 — DPO appointed (if required) EOF ``` ### Step 3: Assess CCPA/CPRA Compliance ```bash # CCPA consumer rights verification cat << 'EOF' CCPA/CPRA Audit Checklist: [ ] Right to Know — Process for consumers to request collected data [ ] Right to Delete — Deletion mechanism and verification [ ] Right to Opt-Out — "Do Not Sell" link on website [ ] Right to Non-Discrimination — No service denial for exercising rights [ ] Right to Correct — Mechanism to correct inaccurate personal info [ ] Right to Limit Use of Sensitive PI — Restrict processing [ ] Financial incentive disclosures — Document value of data [ ] Service provider contracts — Include CCPA clauses [ ] Data retention schedule — Defined and enforced EOF ``` ### Step 4: Assess HIPAA Compliance ```bash # HIPAA Security Rule technical safeguards check # Verify encryption of PHI at rest find /data/health -type f -name "*.db" -exec file {} \; | \ grep -v "encrypted\|SQLCipher" # Check access controls on PHI systems getfacl /data/health/ 2>/dev/null # Verify audit logging for PHI access grep -c 'health_records' /var/log/audit/audit.log ``` ### Step 5: Conduct Data Protection Impact Assessment ```bash # Generate DPIA template for high-risk processing python3 -c " import json dpia = { 'processing_activity': 'Customer profiling for marketing', 'data_categories': ['behavioral', 'demographic', 'purchase_history'], 'necessity_assessment': { 'purpose': 'Personalized marketing recommendations', 'lawful_basis': 'legitimate_interest', 'proportionality': 'Data limited to purchase and browsing history', }, 'risks': [ { 'risk': 'Unwanted profiling without awareness', 'likelihood': 'medium', 'severity': 'high', 'mitigation': 'Transparent opt-out mechanism', }, { 'risk': 'Data breach exposing behavioral profiles', 'likelihood': 'low', 'severity': 'high', 'mitigation': 'Encryption at rest and in transit', }, ], 'dpo_consultation': True, 'supervisory_authority_consultation': False, } print(json.dumps(dpia, indent=2)) " ``` ### Step 6: Verify Data Subject Rights Implementation ```bash # Test SAR (Subject Access Request) endpoint curl -s -X POST "https://target.com/api/privacy/sar" \ -H "Authorization: Bearer $USER_TOKEN" \ -H "Content-Type: application/json" \ -d '{"request_type": "access"}' | jq '.status, .estimated_days' # Test deletion request endpoint curl -s -X POST "https://target.com/api/privacy/delete" \ -H "Authorization: Bearer $USER_TOKEN" \ -H "Content-Type: application/json" \ -d '{"request_type": "erasure", "scope": "all"}' | jq '.status' ``` ## Detection Opportunities | Signal | Source | Description | |--------|--------|-------------| | Bulk PII export | DLP | Large volume personal data extraction | | Consent record modification | Application logs | Tampering with consent records | | PHI access without authorization | HIPAA audit logs | Unauthorized health data access | | Cross-border data transfer | Network monitor | PII sent to non-adequate jurisdictions | ```yaml title: Bulk Personal Data Export Detected id: e5f6a7b8-c9d0-1234-ef01-23456789abcd status: experimental description: Detects large-scale export of personal data records logsource: category: application detection: selection: action: "data_export" record_count|gt: 1000 filter_authorized: user.role: "dpo" condition: selection and not filter_authorized falsepositives: - Authorized data migration by DPO or data engineering team level: high tags: - attack.t1530 - attack.collection ``` ## Verification - [ ] Data processing inventory completed with PII mapping - [ ] Lawful basis documented for each processing activity - [ ] Data subject rights endpoints tested and functional - [ ] DPIA conducted for high-risk processing activities - [ ] Consent management mechanism verified - [ ] Breach notification process documented and tested - [ ] Privacy policy reviewed for accuracy and completeness ## References - [GDPR Full Text](https://gdpr-info.eu/) - [CCPA/CPRA Text](https://oag.ca.gov/privacy/ccpa) - [HIPAA Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/) - [ICO DPIA Guidance](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/data-protection-impact-assessments-dpias/)