Doncheli Data Policy

Don Cheli: Data Policy Auditor

Instructions

1. Scan the codebase for PII and sensitive data patterns:

• Database models / schemas for fields like email, phone, name, address, IP, location
• API request/response payloads
• Logging statements that may capture sensitive fields
• Third-party integrations that receive user data

1. Build a data inventory table: field name, model, purpose, retention, shared with
2. Check against common compliance requirements:

• GDPR: lawful basis, right to erasure, data minimization
• CCPA: disclosure, opt-out
• SOC2: access controls, encryption at rest/transit

1. Flag violations as [critical | warning | info]
2. Generate a draft Privacy Notice section if requested (--generate-notice)
3. Save the audit to .dc/data-policy-audit-.md
4. Never make assumptions about compliance status — only report findings and flag gaps

Output Format

## Data Policy Audit — 2026-03-28

### Data Inventory
| Field     | Model      | Purpose       | Retention | Shared With     |
|-----------|-----------|---------------|-----------|----------------|
| email     | User       | Auth, comms   | Indefinite| SendGrid, Auth0|
| ip_address| AuditLog   | Security      | 90 days   | Internal only  |

### Compliance Gaps
🔴 CRITICAL: ip_address logged in plain text in audit_logs — encrypt or hash
🟡 WARNING:  No data retention policy enforced for User.email — GDPR Art. 5(e)
🟢 INFO:     No right-to-erasure endpoint found — required for GDPR compliance

### Recommendations
1. Add @Encrypted() decorator to ip_address field
2. Implement DELETE /users/:id endpoint that purges all PII
3. Document data retention in Privacy Policy

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: doncheli
• Source: doncheli/don-cheli-sdd
• License: Apache-2.0
• Homepage: https://doncheli.tv

Install and usage instructions live in the source repository linked above.