How to use the GDPR Audit Prep agent skill

What the gdpr-audit-prep skill makes the agent do

When the skill runs, the agent asks six questions about your privacy work. The questions cover records of processing (Article 30), lawful basis (Article 6), data protection impact assessments (Article 35), data subject requests (Articles 15-22), international transfers (Article 46 and the Schrems II approach), and the breach log (Article 33(5)). Each finding is tied to a specific GDPR article.

The skill then produces a structured readiness report. It includes a traffic-light verdict (green DPA-READY, yellow GAPS-IDENTIFIED, red NOT-READY), the top three actions to take, and a section listing points that need outside counsel.

Install the skill from the ZIP download

Download the ZIP for gdpr-audit-prep from our page. The skill is published as a single file, SKILL.md, inside the compliance-os skills folder of the alirezarezvani/claude-skills repository.

Option A, personal install: unzip the file into ~/.claude/skills/ so the skill is available across your projects.

Option B, project install: unzip the file into the .claude/skills/ folder of a specific project so only that project uses it.

Option C, Claude apps: open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal: ~/.claude/skills/
• Project: .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills

Prepare the input files and helper scripts

The skill's workflow reads local JSON files that describe your processing activities: compliance_state.json, processing_activity.json, dsar_log.json and program.json. You create these from your own records. The skill does not supply them.

The workflow also calls helper scripts stored under ra-qm-team/gdpr-dsgvo-expert and a cross-framework mapper. The source does not include those vendor scripts in the file provided, so you need the compliance-os plugin installed with those referenced scripts available. Python is needed to run them.

• compliance_state.json: overall compliance posture
• processing_activity.json: the activity to assess for DPIA needs
• dsar_log.json: recent data subject requests
• program.json: input for the cross-framework mapper

Trigger the skill with a natural request or command

The skill's command is /compliance-os:gdpr-audit-prep followed by a scope, for example the name of a product, team or business unit. Agents that support the plugin can also be asked in plain language to prepare for a GDPR audit, and the skill description tells the agent when to use it: before an annual internal GDPR review, after a breach, when preparing for a DPA investigation, or during acquisition due diligence.

Be specific about the scope so the report names the right activities.

• Run /compliance-os:gdpr-audit-prep checkout-service before our annual internal GDPR review.
• Prepare a GDPR readiness check for the marketing analytics platform after last month's breach.
• We have a supervisory authority inquiry next week. Run the GDPR audit prep for the customer support system.

Read the readiness report

The report starts with the decision being made (for example RoPA-refresh, DPIA-required, DSAR-workflow, transfer-risk, breach-followup or DPA-readiness). It then has sections for the Article 30 RoPA, Article 6 lawful basis, Article 35 DPIA quality, data subject rights, Article 28 processor management, Schrems II transfer status, Article 33-34 breach discipline and cross-framework impact.

Every finding cites an article and paragraph. Check the Outside Counsel section first if your case is novel or disputed, because the skill itself flags those points for a lawyer.

• Verdict: DPA-READY, GAPS-IDENTIFIED or NOT-READY
• Top 3 Actions with owner and timeline
• Outside Counsel Required list

Safety notes before you run it

The skill runs Python scripts, so review the scripts in the vendor folder before running them on real data. The source states that the skill runs scripts and does not use the network. The skill sets out the questions and report format, but the files do not show it checking your actual systems, so the report reflects what your JSON inputs say.

Treat the report as preparation material, not a legal opinion. The skill itself says novel or ambiguous points need outside counsel, and it cannot replace a qualified lawyer or Data Protection Officer.

• Runs scripts: yes. Review them first.
• Uses network: no.
• Does not verify live records; it checks what you put in the JSON files.
• Scope is EU GDPR rules and citations only.

Tips for a useful first run

Start with one scope and a small set of activities so the input files stay accurate. Keep the last-updated dates in your RoPA current, because the questions ask for them. Use the report to build a list of gaps and owners, then rerun the skill after you fix them to see the verdict change.

• Fill in real dates and counts in the JSON files; the questions ask for them directly.
• Run it before the quarterly RoPA refresh and after any high-risk launch.
• Pair it with the ISO 27001 or AI Act skills when the report flags overlapping controls.