auditing-privacy-compliance

# Discover databases and data stores containing personal data
# Scan for PII patterns in database schemas
python3 -c "
import json

pii_columns = [
    'email', 'phone', 'ssn', 'social_security', 'date_of_birth',
    'address', 'credit_card', 'ip_address', 'first_name', 'last_name',
    'passport', 'driver_license', 'medical_record', 'diagnosis',
]

# Simulated schema scan — replace with actual DB introspection
schemas = {
    'users': ['id', 'email', 'first_name', 'last_name', 'phone', 'address'],
    'orders': ['id', 'user_id', 'credit_card', 'billing_address'],
    'health_records': ['id', 'patient_id', 'diagnosis', 'ssn'],
}

findings = []
for table, columns in schemas.items():
    pii_found = [c for c in columns if any(p in c for p in pii_columns)]
    if pii_found:
        findings.append({'table': table, 'pii_columns': pii_found})

print(json.dumps(findings, indent=2))
"

# GDPR compliance checklist assessment
cat << 'EOF'
GDPR Audit Checklist:
[ ] Art. 5  — Data processing principles documented
[ ] Art. 6  — Lawful basis identified for each processing activity
[ ] Art. 7  — Consent freely given, specific, informed, unambiguous
[ ] Art. 13 — Privacy notice provided at collection point
[ ] Art. 15 — Subject access request (SAR) process implemented
[ ] Art. 17 — Right to erasure / right to be forgotten process
[ ] Art. 20 — Data portability mechanism available
[ ] Art. 25 — Privacy by Design and by Default implemented
[ ] Art. 30 — Records of Processing Activities maintained
[ ] Art. 33 — Breach notification process (72-hour requirement)
[ ] Art. 35 — DPIA conducted for high-risk processing
[ ] Art. 37 — DPO appointed (if required)
EOF

# CCPA consumer rights verification
cat << 'EOF'
CCPA/CPRA Audit Checklist:
[ ] Right to Know — Process for consumers to request collected data
[ ] Right to Delete — Deletion mechanism and verification
[ ] Right to Opt-Out — "Do Not Sell" link on website
[ ] Right to Non-Discrimination — No service denial for exercising rights
[ ] Right to Correct — Mechanism to correct inaccurate personal info
[ ] Right to Limit Use of Sensitive PI — Restrict processing
[ ] Financial incentive disclosures — Document value of data
[ ] Service provider contracts — Include CCPA clauses
[ ] Data retention schedule — Defined and enforced
EOF

# HIPAA Security Rule technical safeguards check
# Verify encryption of PHI at rest
find /data/health -type f -name "*.db" -exec file {} \; | \
  grep -v "encrypted\|SQLCipher"

# Check access controls on PHI systems
getfacl /data/health/ 2>/dev/null

# Verify audit logging for PHI access
grep -c 'health_records' /var/log/audit/audit.log

# Generate DPIA template for high-risk processing
python3 -c "
import json

dpia = {
    'processing_activity': 'Customer profiling for marketing',
    'data_categories': ['behavioral', 'demographic', 'purchase_history'],
    'necessity_assessment': {
        'purpose': 'Personalized marketing recommendations',
        'lawful_basis': 'legitimate_interest',
        'proportionality': 'Data limited to purchase and browsing history',
    },
    'risks': [
        {
            'risk': 'Unwanted profiling without awareness',
            'likelihood': 'medium',
            'severity': 'high',
            'mitigation': 'Transparent opt-out mechanism',
        },
        {
            'risk': 'Data breach exposing behavioral profiles',
            'likelihood': 'low',
            'severity': 'high',
            'mitigation': 'Encryption at rest and in transit',
        },
    ],
    'dpo_consultation': True,
    'supervisory_authority_consultation': False,
}
print(json.dumps(dpia, indent=2))
"

# Test SAR (Subject Access Request) endpoint
curl -s -X POST "https://target.com/api/privacy/sar" \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"request_type": "access"}' | jq '.status, .estimated_days'

# Test deletion request endpoint
curl -s -X POST "https://target.com/api/privacy/delete" \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"request_type": "erasure", "scope": "all"}' | jq '.status'

title: Bulk Personal Data Export Detected
id: e5f6a7b8-c9d0-1234-ef01-23456789abcd
status: experimental
description: Detects large-scale export of personal data records
logsource:
  category: application
detection:
  selection:
    action: "data_export"
    record_count|gt: 1000
  filter_authorized:
    user.role: "dpo"
  condition: selection and not filter_authorized
falsepositives:
  - Authorized data migration by DPO or data engineering team
level: high
tags:
  - attack.t1530
  - attack.collection