GDPR Compliance Verification Agent for Websites and Applications
This agent analyzes your personal data processing and verifies its compliance with the General Data Protection Regulation (GDPR). It identifies compliance gaps, assesses associated risks, and generates a prioritized remediation plan with concrete recommendations.
For who
DPOs, compliance officers, corporate lawyers, GDPR consultants, and SMB executives looking to quickly audit their GDPR compliance.
Input
Description de l'organisation, de ses activités, des traitements de données personnelles réalisés (formulaires, bases clients, RH, marketing, sous-traitants, outils utilisés), des mesures de sécurité en place et des documents de conformité existants (politique de confidentialité, registre des traitements, CGU/CGV, contrats sous-traitants).
steps (4)
Processing Activities Mapping
promptAnalysis and structuring of all declared personal data processing activities
Article-by-Article Compliance Audit
promptSystematic verification of each processing activity's compliance with key GDPR requirements
Risk Assessment and Prioritization
promptClassification of gaps by risk level and remediation urgency
Detailed Remediation Plan
promptGeneration of a concrete corrective action plan with owners and deadlines
Output
Rapport de conformité RGPD complet comprenant : registre des traitements cartographié, grille d'audit article par article avec statuts de conformité, matrice des risques priorisée, et plan de remédiation détaillé avec actions correctives, responsables, échéances et indicateurs de succès.
Example
Input
Our B2B SaaS company (50 employees, 5M EUR revenue) publishes HR management software. We collect data from our clients (companies) and their employees: name, first name, email, social security number, pay slips, sick leave. Hosted on AWS Ireland and AWS US-East. We use Google Analytics, HubSpot for marketing, and Slack internally. No appointed DPO. Privacy policy dating from 2019. Cookie consent via a simple banner 'By continuing, you agree'. No formalized processing register. Payroll subcontractor based in Tunisia without specific contractual clauses.
Output
**Overall compliance score: 35/100 — Critical level** **Register**: 8 processing activities identified, including 3 at very high risk (employee health data, social security numbers, pay slips). **Critical gaps P1**: - No DPO despite being mandatory (large-scale sensitive data processing, Art. 37) - Payroll data transfer to Tunisia without valid transfer mechanism (Art. 44-49) - Health data processing without DPIA (Art. 35) - Cookie banner non-compliant (no equivalent refusal option, consent not freely given) **Important gaps P2**: - Outdated and incomplete privacy policy - No formalized processing register (Art. 30) - Processor contracts without Art. 28 clauses **Phase 1 (urgent)**: Appoint a DPO, suspend Tunisia transfer or implement SCCs, complete the DPIA, redo cookie banner with compliant CMP. **Phase 2**: Update privacy policy, formalize the register, renegotiate processor contracts. **Phase 3**: Train teams, implement rights exercise process, plan semi-annual audits.
Customization
| Parameter | Description | Default |
|---|---|---|
| Secteur d'activité | Secteur de l'organisation pour adapter les exigences sectorielles spécifiques (santé, finance, e-commerce, RH, éducation) | Généraliste |
| Niveau de détail du rapport | Granularité souhaitée pour le rapport : synthétique (direction), standard (DPO), ou exhaustif (audit formel CNIL) | Standard |
| Référentiel complémentaire | Référentiels additionnels à croiser avec le RGPD : recommandations CNIL, ISO 27701, ePrivacy, CCPA, guidelines EDPB | Recommandations CNIL |
Technical Notes
This agent performs an analysis based on declarative information provided by the user. It does not replace a field audit or personalized legal advice. For organizations processing sensitive data at large scale (health, biometrics, judicial data), it is recommended to complement this analysis with a consultation with a certified DPO or specialized firm.
The prompts are calibrated on the GDPR (EU Regulation 2016/679) and EDPB (European Data Protection Board) guidelines. For multi-jurisdictional compliance, activate the appropriate complementary framework (CCPA for the United States, LGPD for Brazil, etc.).
For a more thorough audit, provide your existing documents as input: privacy policy, processing register, processor contracts, completed DPIAs. The agent can then perform a comparative analysis between your documents and regulatory requirements.
Related Prompts
Write a Clear and Legally Sound Formal Notice
This prompt generates a complete, structured formal notice adapted to your legal situation, with appropriate legal grounds.
Sora Prompt for Analyzing a Contract
Contract analysis is a complex task that requires careful attention to legal details, potentially disadvantageous clauses, and reciprocal obligations of the parties. Sora, with its advanced natural language processing capabilities, can assist you in this process by quickly identifying critical points in a contractual document. Whether you are an entrepreneur, freelancer, or legal manager, using Sora to analyze a contract saves considerable time while reducing the risk of missing a problematic clause. The AI particularly excels at detecting drafting ambiguities, identifying unfair clauses, and summarizing mutual commitments. Of course, Sora's analysis does not replace the advice of a legal professional, but it serves as an extremely effective first filter for understanding the scope of a contract before signing. In this guide, we offer an optimized prompt to get the most out of Sora in contract analysis, with variants adapted to your level of expertise and the complexity of the document under review.
Compliance Audit Framework
Conducting internal compliance audits
Contract Clause Drafter
Drafting specific contract clauses