complylisted

# Comply — Compliance & Governance ## Activate When - User invokes `/godmode:comply` - User says "are we GDPR compliant?", "audit trail", "privacy review", "compliance check" - Team builds features handling personal data, health data, or payment data - Pre-ship check when `/godmode:ship` detects regulated data flows - User needs license compliance audit across dependencies - Preparing for SOC2 audit or regulatory review ## Workflow ### Step 1: Define Compliance Scope Determine which regulations and what code is in scope: ``` COMPLIANCE SCOPE: Target: <feature/module/entire project> Applicable regulations: - [ ] GDPR (personal data of EU residents) - [ ] HIPAA (protected health information) - [ ] SOC2 (service organization controls) - [ ] PCI-DSS (payment card data) - [ ] CCPA (California consumer privacy) - [ ] FERPA (educational records) - [ ] Other: <specify> Data classification: Personal data: <files/modules handling PII> Sensitive data: <files/modules handling health/financial/auth data> Public data: <files/modules with non-sensitive data> ``` ### Step 2: GDPR Compliance Check If personal data of EU residents is processed: #### Lawful Basis ``` GDPR — LAWFUL BASIS ASSESSMENT: | Data Processing Activity | Lawful Basis | Status | |--|--|--| | User registration | Consent | COMPLIANT | | Order processing | Contract | COMPLIANT | | Marketing emails | Consent | MISSING | | Analytics tracking | Legitimate int. | REVIEW | | Fraud detection | Legitimate i