Compliance Policy Auditor

Systematically reviews technical or procedural documentation to identify alignment or deviations from major regulatory frameworks.

🎯 When to Use

• User provides a "Privacy Policy" or "Data Retention Plan" for review.
• User asks: "Is this process SOC2 compliant?" or "What GDPR risks exist here?"
• Do NOT use for providing binding legal advice or drafting contracts.
• Do NOT use for auditing physical security (cams, locks) unless documented.

🧠 Core Workflow

Step 1 — Scope & Framework Selection IF user specifies a framework (GDPR/SOC2/HIPAA/ISO27001), prioritize its rules; ELSE, apply General Data Protection principles.

Step 2 — Data Mapping Identify PII (Personally Identifiable Information), PHI (Protected Health Information), or PCI data mentioned in the text.

Step 3 — Gap Analysis

1. Data Minimization — Check if only necessary data is collected.
2. Access Control — Audit description of "Who has access" (RBAC).