gdpr-audit-prep

Topics in the source

• /compliance-os:gdpr-audit-prep — GDPR DPO Forcing Questions
• When to Run
• The Six DPO Questions
• 1. Show me the Article 30 RoPA — with last-updated date.
• 2. For this processing activity, what's the lawful basis under Article 6?
• 3. For high-risk processing, where's the DPIA per Article 35?
• 4. Show me a DSAR from the last 30 days — and the response timing.
• 5. Show me Transfer Impact Assessments for the largest non-EU transfers.

Command: /compliance-os:gdpr-audit-prep The GDPR DPO auditor pressure-tests any privacy compliance work. Six Article-cited questions before any internal audit, breach response, DPA investigation, or acquisition due diligence. Before annual internal GDPR audit Before quarterly Article 30 RoPA refresh Before launching new high-risk processing (Article 35 DPIA required) Post-breach (Articles 33-34) Before DPA investigation response or supervisory authority engagement During acquisition due diligence (target company privacy posture) Quarterly during high-volume new-feature shipping Most-cited finding area. Must include all Article 30(1)(a)-(g) elements for controllers Must include all Article 30(2)(a)-(d) elements for processors Updated within reasonable time of changes (90 days expected) Joint controller arrangements documented per Article 26 Article 6 is exclusive — pick ONE basis per purpose. Six options: consent / contract / legal obligation / vital interests / public task / legitimate interests Where "legitimate interests": LIA documented Where "consent": records per Article 7; withdrawal mechanism Special categories (Article 9) require an Article 9(2) exception Required for high-

This is an excerpt. Refer to the complete source and its current requirements.