Consent Log Audit

consent-log-audit

Read an exported consent log and return the rows a human has to act on before an assessment. The audit is read-only: it never edits the export and never writes back to the consent platform.

Before you start

Confirm the export carries every column in the log schema. An export missing renewed_at is a partial export, and the audit says so instead of guessing.

Procedure

1. Load the export and confirm the column set against the schema.
2. Drop every row whose consent_state is withdrawn. A withdrawn consent has nothing left to expire, and leaving it in the working set double-counts it in the summary.
3. For each remaining row, compute the retention deadline as expires_at = granted_at + retention_days.
4. Report every row whose expires_at is in the past as an expired consent that must be re-collected before the record is used again.
5. Report separately every row with no lawful_basis, and every row whose consent_state is active but whose withdrawn_at is populated. Those two are data-quality defects, not retention defects, and they are fixed in the platform rather than by re-collecting.

Output

A table of rows needing action, grouped by the three categories in steps 4 and 5, with a count per category and the oldest offending row per category. Do not paste the whole export back.