/gdpr

name: memstack-business-gdpr
description: "Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR applies and how critical it is, then reports required roles, obligations, and remediation. Do NOT use for general security audits (use owasp-top10) or contract drafting (use contract-template)."
version: 1.0.0
license: "Proprietary, MemStack™ Pro by CW Affiliate Investments LLC. See LICENSE.txt"

GDPR: Personal-data assessment from the repo...

*Scans a repository for evidence of personal data collection, classifies sensitivity under GDPR, decides whether GDPR applies and how critical the obligations are, and reports the required roles, articles to satisfy, and remediation plan.*

Activation

When this skill activates, output:

`GDPR, Personal-data assessment from the repo...`

Then execute the protocol below.

Context Guard

| Context | Status | |---------|--------| | User says "GDPR", "data protection", "privacy compliance" | ACTIVE | | User asks "do I need GDPR", "does GDPR apply to this project" | ACTIVE | | User says "DSAR", "right to be forgotten", "cookie consent", "DPA" | ACTIVE | | User asks about CCPA, LGPD, PIPEDA, UK GDPR | ACTIVE | | User wants a generic security audit | DORMANT: use owasp-top10 | | User wants a service agreement or NDA | DORMANT: use contract-template | | User wants RLS / database access policies | DORMANT: use rls-checker |

Common Mistakes

| Mistake | Why It's Wrong | |---------|---------------| | "We're a US company so GDPR doesn't apply" | GDPR follows the data subject, not the company. Any EU/UK resident's data triggers it. | | "Hashed emails aren't personal data" | Hashes are still personal data if reversible or linkable. True anonymisation is irreversible. | | "Cookie banner with only Accept" | Reject must be equally prominent. Pre-ticked = invalid consent. | | "Legitimate interest covers everything" | Requires a documented balancing test. Cannot be used for special category data or marketing to children. | | "We'll get the DPA later" | Article 28 requires a written DPA *before* processing begins. | | "72-hour clock starts after we finish investigating" | The clock starts on *awareness* of a likely breach. |

**Disclaimer:** Produces a compliance assessment, not legal advice. Engage a qualified DPO or data-protection lawyer before relying on outputs for regulated processing.

Protocol

Step 1: Scan the repo for personal-data signals

Don't ask the user what they collect, find out from the code. Run discovery against every relevant surface:

**Database schemas / migrations**

find . \( -name "*.sql" -o -name "schema.prisma" -o -name "models.py" -o -name "*.dbml" \) -not -path "*/node_modules/*"
grep -rEin "email|phone|address|first_?name|last_?name|date_?of_?birth|dob|ssn|passport|tax_?id|national_?id|ip_?address|geo|lat|lng|location|gender|race|religion|health|medical|biometric|fingerprint|face|child|minor" --include="*.sql" --include="*.prisma" --include="*.py" --include="*.ts"

**Form / UI input fields**

grep -rEin "<input[^>]*name=|formField|FormControl|registerField" --include="*.tsx" --include="*.jsx" --include="*.vue" --include="*.svelte"
grep -rEin "type=[\"']email[\"']|type=[\"']tel[\"']|autoComplete=[\"'](name|email|tel|address|cc-|bday)" .

**API request schemas / DTOs**

grep -rEin "z\.object|class.*BaseModel|interface.*Request|Schema\(" --include="*.ts" --include="*.py"

**Auth configuration**

find . -iname "auth*" -o -iname "*supabase*" -o -iname "*clerk*" -o -iname "*next-auth*" -o -iname "*firebase*"
grep -rEin "providers:|GoogleProvider|GitHubProvider|EmailProvider|magicLink|phoneSignIn"

**Analytics / tracking SDKs**

grep -rEin "posthog|mixpanel|amplitude|segment|google-?analytics|gtag|fbq|hotjar|fullstory|datadog.*RUM|sentry" .

**Cookies / sessions**

grep -rEin "Set-Cookie|cookies\.set|res\.cookie|getServerSession|session\(" .

**Logging that may capture PII**

grep -rEin "console\.log.*req\.|logger\.(info|debug).*body|print\(.*request" .

**Third-party data recipients**

cat package.json requirements.txt pyproject.toml composer.json Gemfile 2>/dev/null | grep -Ei "stripe|paypal|sendgrid|mailgun|twilio|openai|anthropic|hubspot|intercom|zendesk|algolia"

**Existing privacy artifacts (gap check)**

find . \( -iname "privacy*" -o -iname "*dpa*" -o -iname "ropa*" -o -iname "cookie-policy*" -o -iname "data-processing*" \)

Record findings in a working table:

| Source | Field / Signal | Personal Data? | Sensitivity Class |
|--------|---------------|----------------|-------------------|
| db/schema.sql L42 | users.email | Yes | Identifier |
| db/schema.sql L43 | users.phone | Yes | Identifier |
| src/forms/Profile.tsx L18 | dob input | Yes | Identifier (age) |
| src/forms/Health.tsx L7 | medical_conditions | Yes | **Special category (Art 9)** |
| package.json | posthog-js | Yes: behavioral | Behavioral |
| src/api/users.ts L88 | logger.info(req.body) | Possible PII leak | Risk |

If no personal-data signals are found, jump to Step 3 with verdict NO and stop.

Step 2: Classify sensitivity

Bucket every confirmed finding into one or more of:

| Class | Examples | GDPR Treatment | |-------|----------|----------------| | **Identifier** | name, email, phone, address, account ID, IP | Standard personal data, Art 6 lawful basis required | | **Financial** | card number, bank account, billing address | Standard personal data + PCI scope considerations | | **Location** | precise GPS, geo, IP-derived city | Standard personal data; precise location may require explicit consent | | **Behavioral** | clickstream, page views, session recording, fingerpri