compliance-auditor

Audit feature specifications against India's DPDP Act 2023 and generate compliance gap reports.

11|Updated Mar 20, 2026
One-click install
npx skills add https://github.com/qa-aman/next-leap-claude-code --skill compliance-auditor-qa-aman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: compliance-auditor
Source: https://github.com/qa-aman/next-leap-claude-code/tree/main/.claude/skills/compliance-auditor
Command: npx skills add https://github.com/qa-aman/next-leap-claude-code --skill compliance-auditor-qa-aman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Product teams writing feature specs that handle user data often miss regulatory requirements, exposing the company to penalties of up to Rs 250 crore under India's Digital Personal Data Protection Act 2023. This Skill systematically audits a spec for DPDP compliance before engineering review. ## Core Features & Use Cases - Data Element Inventory: Extracts every data element from a spec, classifies it as personal data, and maps it to applicable DPDP sections. - Children's Data Audit: Applies the strict Section 9 checks for guardian consent, behavioral monitoring, targeted advertising, and detrimental processing. - Gap Report Generation: Produces a structured audit report with compliance status, penalty exposure, and specific fix recommendations per gap. - Use Case: Before shipping a feature that collects user names, usage analytics, and age data, run the audit to verify consent mechanisms, retention periods, masking policies, and Data Principal rights workflows are all defined in the spec. ## Quick Start Audit the Smart Follow-Up feature spec in 08-product-features against DPDP Act 2023 requirements and list all compliance gaps.

Frequently Asked Questions about compliance-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a feature spec for DPDP Act compliance?▼

Provide the feature spec and the audit extracts every data element, classifies personal data, maps each element to DPDP sections, and checks consent, retention, security, and erasure policies. The output is a gap report with specific fixes and penalty references.

What does the DPDP Act 2023 require for children's data?▼

Section 9 requires verifiable guardian consent before processing data of anyone under 18, and prohibits tracking, behavioral monitoring, targeted advertising, and detrimental processing of children. Violations carry penalties up to Rs 200 crore.

Does the audit cover consent and data retention requirements?▼

Yes, it verifies consent is free, specific, informed, and itemized per Section 6, and that each data element has a finite retention period and erasure procedure per Section 8. Bundled consent buried in T&C is flagged as a gap.

Can the audit handle analytics events and linkable data?▼

Yes, analytics events and any data linkable to a person, including via session IDs, are treated as personal data under DPDP and included in the inventory. Uncertain classifications are flagged for review rather than assumed compliant.

What are the limitations of an automated DPDP compliance audit?▼

The audit only checks what is explicitly stated in the spec, so undocumented policies are flagged as gaps even if they exist elsewhere. Items marked Needs Review still require discussion with legal counsel before sign-off.