# GDPR Desk

> Paste one product's personal-data inventory - a row per data item or store, with its system, data, data subjects, purpose, lawful basis, retention, recipients, location, safeguard and security - plus notes on how the product works, and see where it breaks the GDPR. The browser flags special-category (Art. 9) and criminal-offence (Art. 10) data, missing lawful bases, missing or excessive retention, transfers outside the EEA with no safeguard, weak password hashing, unmasked logs and production data in staging, and reads the DPIA criteria, for free. Then an audit lane writes findings with the article, a word-for-word quote and the fix, and a record lane writes the Article 30(1) record of processing activities.

URL: https://gdpr-desk.skillsafe.ai/
API tutorial: https://gdpr-desk.skillsafe.ai/api.html

## Who it is for

Engineers, product owners, privacy leads and DPOs at a company processing EU personal data who keep (or need to start) a data inventory and want to know, before an audit or a launch, which rows break the GDPR as written and what the record of processing activities should say.

## The free scan (in the browser, no model)

- The inventory as CSV, TSV, a Markdown or a pipe table with a header row; recognised columns (with aliases): System, Data, Category, Subjects, Purpose, Legal basis, Retention, Recipients, Location, Safeguard, Security, DPA, Notes. Only a Data (or Category) column is required.
- Data categories per row from the data, category and notes cells: special category (Art. 9: health, biometric, genetic, religion, ethnicity, politics, trade-union membership, sex life), criminal-offence data (Art. 10), financial, government id, credentials, location, online identifiers, contact; children (under 16, Art. 8) and employees from the subjects; logs and non-production systems from the system.
- The lawful basis normalised to the six of Art. 6 (consent, contract, legal obligation, vital interests, public task, legitimate interests) or missing / unrecognised, and any Art. 9(2) or Art. 10 condition named in the basis or notes.
- Retention as a period (in days), an event ("until account deletion"), indefinite or missing, and against the engineering defaults: sessions 90 days, email and notification logs 6 months, auth and audit logs 24 months, analytics 13 months.
- Every location as EEA, adequate (an EU adequacy decision: UK, Switzerland, Japan, Canada, South Korea, Israel, New Zealand and others), United States (adequate only for recipients certified under the EU-US Data Privacy Framework) or third country; cloud region codes such as eu-west-1 or us-east-1 are read too.
- The nine DPIA criteria (profiling, automated decisions, systematic monitoring, sensitive data, large scale, combined datasets, vulnerable subjects, innovative technology, blocking a right or service): two or more, or special-category data at large scale (Art. 35(3)(b)), means a DPIA is required; one means recommended.
- Which of the six data-subject rights (access, rectification, erasure, restriction, portability, objection) and breach handling the notes describe.
- Flags GD-01..GD-17: no lawful basis; Art. 9 data with no condition; Art. 10 data with no legal authorisation; third-country transfer with no safeguard; US with no mechanism named; retention missing or indefinite; retention longer than the default; vague purpose; consent for employee data; children's data on consent with no parental consent; sensitive data unencrypted; passwords not hashed with Argon2id, bcrypt, scrypt or PBKDF2; a recipient with no DPA; logs with IPs or request bodies unmasked; personal data in a development, test or staging system; rights not described; breach handling not described.
- The rows grouped by purpose and basis into processing activities, and the Art. 30 completeness. Exports: the scan as Markdown and the reading as CSV.

## The paid lanes (one system prompt, routed on `task`)

- `audit`: a verdict (ready, fix first, stop - stop needs a high finding, ready allows no high or medium one); every page flag confirmed or disputed with a reason; 1-15 findings sorted by severity, each with the rows, the article, a word-for-word quote and a concrete fix, every confirmed high or medium flag covered; the DPIA call, never below the page's reading; the six rights marked ready only where the notes describe them.
- `ropa`: the Article 30(1) record of processing activities - one entry per activity with its purpose, lawful basis (the one its rows state, or [missing]), Art. 9 / Art. 10 condition, data subjects, data categories, recipients, transfers outside the EEA and their safeguards, retention and security; every inventory row placed in exactly one activity; a [placeholder] and a gap wherever the inventory is silent. An audit hands over to it with one button, and its findings become the record's gaps.

Every reply is checked against the input: one answer per flag in order; real row ids; quotes word for word; the DPIA no lower than the page's reading; every row in exactly one activity with one basis; every country outside the EEA listed as a transfer and no other; no lawful basis, retention period, safeguard or figure the input, the page's reading or the skills do not contain. It assesses the inventory as written and is not legal advice.

## Input and output

Run input (all strings): `task` ("audit" or "ropa"), `controller`, `today` (YYYY-MM-DD), `inventory` (rows as "R1: system | data | subjects | purpose | basis | retention | recipients | location | safeguard | security | dpa | notes"), `context` (lines as "C1: ..."), `facts` (the page's reading as a JSON string), optional `question`, optional `audit_handoff` (ropa only) and `retry_note`. The reply is one JSON object per the lane's contract; the API tutorial documents both with worked examples.

## Source

- @wshobson/gdpr-data-handling - https://skillsafe.ai/skill/@wshobson/gdpr-data-handling - wshobson/agents (plugins/hr-legal-compliance), MIT, by Seth Hobson: personal-data categories, the Art. 6 lawful bases, data-subject rights and the 1-month response, consent, retention, breach notification within 72 hours, transfers, the compliance checklist.
- @github/gdpr-compliant - https://skillsafe.ai/skill/@github/gdpr-compliant - github/awesome-copilot, MIT: GDPR engineering rules from Arts. 5, 25, 32, 33 and 35 - purpose, basis and retention per store, the retention defaults, minimisation, encryption, password hashing, log masking, no production data in test, DPAs, EEA regions or SCCs, DPIA, the record of processing activities.
- Built and hosted on SkillSafe (https://skillsafe.ai/). Runs on gpt-terra.