/regulatory-audit-generator

name: regulatory-audit-generator
description: "Builds compliance checklists for business scenarios involving GDPR, PIPL, or advertising/data laws. Outputs a structured checklist with check items, legal basis, risk levels, and actionable recommendations. Triggered by requests like \"run a compliance check,\" \"GDPR/PIPL compliance,\" \"pre-launch review,\" \"privacy impact assessment (PIA/DPIA),\" or asking if a feature is compliant."
license: MIT

Regulatory Audit Generator — Business Scenario Compliance Checklist Builder

Identifies applicable laws and regulations based on the user's business scenario description, and outputs a structured compliance checklist covering major regulations such as GDPR, PIPL (Personal Information Protection Law), Advertising Law, Cybersecurity Law, and Data Security Law.

Quick Start

Users simply describe their business scenario, and the Agent will:

1. **Identify applicable regulations**: Determine which laws and regulations apply based on the business scenario 2. **Generate a checklist**: Output a structured list of check items 3. **Label risk levels**: Prioritize by severity, marking high/medium/low risk 4. **Provide remediation recommendations**: Offer actionable remediation guidance for each compliance risk

Users just need to say: > "We're launching a user profiling feature — help me create a compliance checklist."

The Agent will guide the user to provide necessary information, then output a complete compliance checklist.

---

1. Supported Regulatory Frameworks

Core Regulations

| Regulation | Abbreviation | Scope | Key Focus Areas | |------------|-------------|-------|-----------------| | Personal Information Protection Law | PIPL | Processing personal information within China | Informed consent, data minimization, cross-border data transfer | | General Data Protection Regulation | GDPR | Involving EU user data | Lawful basis, data subject rights, DPO, DPIA | | Data Security Law | DSL | Data processing activities within China | Data classification & grading, security assessment, important data export | | Cybersecurity Law | CSL | Network operators | Multi-Level Protection Scheme (MLPS), log retention, security incident reporting | | Advertising Law | — | Advertising publishing and operations | Prohibited superlative claims, false advertising, medical advertising | | E-Commerce Law | — | E-commerce operators | Information disclosure, user reviews, bundled sales | | Anti-Unfair Competition Law | — | Market business activities | Commercial bribery, false advertising, trade secret infringement | | Consumer Protection Law | — | Consumer rights related | Right to know, fair trade rights, personal information |

Industry-Specific Regulations

| Industry | Relevant Regulations / Standards | |----------|--------------------------------| | Finance | Technical Specification for Personal Financial Information Protection (JR/T 0171), Data Security Management Measures for Banking and Insurance Institutions | | Healthcare | Population Health Information Management Measures, Medical Big Data Standards | | Education | Online Protection Chapter of the Minors Protection Law, Provisions on Protection of Children's Personal Information Online | | Automotive | Several Provisions on Automobile Data Security Management | | Mobile Apps | Methods for Identifying Illegal Collection and Use of Personal Information by Apps, Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Applications |

---

2. Compliance Check Procedure (SOP)

Step 1: Gather Business Scenario Information

Confirm the following key information with the user:

| Dimension | Information to Confirm | Example | |-----------|----------------------|---------| | Business Description | Specific content of the feature/service | "User profiling feature that recommends products based on behavioral data" | | User Group | Geographic region and demographics of target audience | "Mainland China users, including minors" | | Data Types | What data is collected/processed | "Name, phone number, browsing history, location data" | | Data Flow | Data storage, transmission, and sharing details | "Stored on Alibaba Cloud East China nodes, shared with third-party ad platforms" | | Business Stage | New launch / existing system needing remediation / M&A due diligence | "New feature, planned for launch next month" | | Existing Measures | Current compliance measures already in place | "Has a privacy policy, but no DPIA completed" |

**If the user has not provided certain information, the Agent should proactively ask follow-up questions rather than assume or skip.**

Step 2: Identify Applicable Regulations

Based on collected information, determine applicable regulations using the following rules:

IF processing personal information → PIPL
IF involving EU users → GDPR
IF involving data storage/transmission → Data Security Law + Cybersecurity Law
IF involving advertising/marketing content → Advertising Law
IF involving e-commerce transactions → E-Commerce Law
IF involving minors → Minors Protection Law + Provisions on Protection of Children's Personal Information Online
IF cross-border data transfer (overseas storage/transmission/access) → PIPL Chapter 3 + Measures for Security Assessment of Data Export
IF involving sensitive personal information → PIPL Chapter 2 Section 2 (separate consent + PIIA)
IF involving automated decision-making → PIPL Article 24 (transparency + right to refuse)
IF involving financial data → JR/T 0171

Step 3: Generate the Compliance Checklist

Output the checklist in the following structure:

Checklist Output Format

# [Business Scenario Name] Compliance Checklist

**Assessment Date**: YYYY-MM-DD
**Business Description**: [Brief description]
**Applicable Regulations**: [List of regulations]

## Checklist

| No. | Check Item | Legal Basis | Risk Level | Current Status | Remediation Advice |
|-----|-----------|-----