Audit template
compliance-privacy
Finds where you process personal data without a lawful basis, consent, or a way to delete it.
Maps to: GDPR · ePrivacy · EU AI Act
How this audit works
Primary lens is GDPR, extended to ePrivacy, the EU AI Act, and CCPA where they apply. A swarm of specialist agents builds a verified data-flow / RoPA map, then checks lawful basis, consent and cookies, transparency, data-subject rights, retention, international transfers, processor contracts, and breach readiness. Consent is verified by network trace, not the banner UI, and erasure and access rights are checked end-to-end in code; every finding cites a specific article and a file, table, cookie, or policy clause.
Use it when
Cookie banner that lies
Marketing ships a consent banner, but analytics and ad pixels still fire on first load. A network trace catches every non-essential tag that runs before opt-in, names the line that injects it, and maps it to ePrivacy and Art. 6 with a gate-before-consent fix.
A user files a deletion request
Support promises erasure in the privacy policy, but no one has traced where the data actually lives. The audit follows each personal-data category and flags where deletion fails to propagate to backups, logs, or third-party processors, against Art. 17.
Shipping an AI feature in the EU
A new profiling or LLM feature goes live without a DPIA or an EU AI Act risk tier. The audit classifies the feature, checks Art. 22 safeguards and AI-transparency duties, and traces whether the data leaves the EEA without a valid transfer mechanism.
What you get
A per-dimension scorecard, a verified data-flow / RoPA map, and a priority-sorted findings register where each finding cites its article and ships a concrete before/after fix, turned into GitHub issues under one tracking issue.