AI GDPR Compliance Audit with Kestra and Mistral AI

id: ai-gdpr-compliance-audit
namespace: company.legal

description: |
  AI-powered GDPR compliance audit that generates a structured checklist
  covering all key regulation areas with JSON-structured findings.

inputs:
  - id: organization_context
    type: STRING
    displayName: Describe your organization and data processing activities
    defaults: |
      Mid-size B2B SaaS company (250 employees) based in France,
      serving customers across the EU. We process customer account data,
      usage analytics, billing information, and support ticket content.
      We use AWS EU (Frankfurt) for hosting, Salesforce for CRM,
      and HubSpot for marketing automation. We have a DPO appointed
      internally. No special category data is processed intentionally.

  - id: audit_focus
    type: SELECT
    displayName: Audit focus area
    defaults: Full GDPR audit
    values:
      - Full GDPR audit
      - Accountability & governance (Chapter II)
      - Lawfulness & consent management (Articles 6-9)
      - Data subject rights (Articles 15-22)
      - Security & breach readiness (Articles 32-34)
      - International transfers (Chapter V)
      - Processor management (Article 28)

  - id: previous_findings
    type: STRING
    displayName: Previous audit findings or known gaps (optional)
    defaults: |
      Last audit (2025-06): Records of processing activities incomplete
      for marketing department. Cookie consent mechanism not yet updated
      for EDPB 2024 guidance. No documented Transfer Impact Assessments
      for US-based sub-processors.

tasks:
  # Step 1, Generate structured audit findings as JSON.
  # This enables downstream automation: ticket creation, dashboard updates,
  # compliance tracking systems.
  - id: audit_findings
    type: io.kestra.plugin.ai.agent.AIAgent
    description: Generate structured GDPR compliance audit findings
    # Mistral Large, European AI model by Mistral AI (Paris, France).
    # Audit descriptions may contain details about internal data processing;
    # EU-hosted inference respects data sovereignty.
    #
    # For on-premise or air-gapped deployments:
    #   type: io.kestra.plugin.ai.provider.Ollama
    #   endpoint: http://ollama:11434
    #   modelName: mistral-large
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
    configuration:
      temperature: 0.1
      maxToken: 8192
      responseFormat:
        type: JSON
        jsonSchema:
          type: object
          required:
            - audit_date
            - overall_maturity
            - findings
            - priority_actions
          properties:
            audit_date:
              type: string
              description: ISO 8601 date of the audit
            overall_maturity:
              type: string
              enum:
                - Initial, ad hoc, no formal programme
                - Developing, some policies but inconsistent
                - Defined, documented programme, partially implemented
                - Managed, full programme with monitoring
                - Optimised, continuous improvement, privacy by design
            findings:
              type: array
              items:
                type: object
                required:
                  - area
                  - gdpr_reference
                  - status
                  - finding
                  - recommendation
                  - priority
                properties:
                  area:
                    type: string
                  gdpr_reference:
                    type: string
                    description: "e.g. Article 30, Article 28(3)(d)"
                  status:
                    type: string
                    enum:
                      - Compliant
                      - Partially compliant
                      - Non-compliant
                      - Not assessed
                  finding:
                    type: string
                  recommendation:
                    type: string
                  priority:
                    type: string
                    enum:
                      - Critical
                      - High
                      - Medium
                      - Low
            priority_actions:
              type: array
              items:
                type: object
                required:
                  - action
                  - deadline_weeks
                  - owner
                properties:
                  action:
                    type: string
                  deadline_weeks:
                    type: integer
                  owner:
                    type: string
                    description: "Suggested responsible role, e.g. DPO, IT, Legal"
    contentRetrievers:
      - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
        maxResults: 5
    systemMessage: |
      You are a certified GDPR auditor (CIPP/E, CIPM equivalent expertise).
      You conduct comprehensive GDPR compliance audits following the
      methodology of European Data Protection Board (EDPB) audit frameworks.

      Rules:
      - Reference specific GDPR articles for every finding
      - Consider EDPB guidelines, WP29 opinions, and recent enforcement trends
      - Use web search to find the latest regulatory guidance and fines
      - Account for previous audit findings and assess remediation progress
      - Be constructive: every non-compliance finding must include a concrete,
        actionable recommendation
      - Assess maturity holistically, not just checkbox compliance
      - Priority levels: Critical (regulatory risk, potential fines),
        High (significant gap), Medium (improvement needed), Low (best practice)
    prompt: |
      Conduct a GDPR compliance audit for the following organization:

      ORGANIZATION CONTEXT:
      {{ inputs.organization_context }}

      AUDIT FOCUS: {{ inputs.audit_focus }}

      PREVIOUS FINDINGS:
      {{ inputs.previous_findings }}

      Assess compliance across these areas (adapt depth based on audit focus):

      1. GOVERNANCE & ACCOUNTABILITY (Articles 5(2), 24, 25, 37-39)
         - Data protection programme maturity
         - DPO appointment and independence
         - Privacy by design and by default
         - Staff awareness and training

      2. LAWFULNESS (Articles 6-9)
         - Legal basis documentation for each processing activity
         - Consent mechanisms (if consent is relied upon)
         - Legitimate interest assessments (LIAs)
         - Special category data handling (if applicable)

      3. RECORDS OF PROCESSING (Article 30)
         - Completeness of ROPA for all departments
         - Controller and processor records

      4. DATA SUBJECT RIGHTS (Articles 12-22)
         - Response procedures and timelines (1 month)
         - Identity verification process
         - Access, rectification, erasure, portability implementation

      5. SECURITY (Articles 32-34)
         - Technical and organisational measures
         - Breach detection, reporting, and response readiness
         - Regular security testing

      6. INTERNATIONAL TRANSFERS (Chapter V, Articles 44-49)
         - Transfer mechanisms (adequacy, SCCs, BCRs)
         - Transfer Impact Assessments
         - Sub-processor locations and safeguards

      7. PROCESSOR MANAGEMENT (Article 28)
         - DPA coverage for all processors
         - Sub-processor approval and monitoring
         - Audit rights exercised

      8. DPIA PROCESS (Articles 35-36)
         - Criteria for when DPIAs are required
         - DPIA methodology and documentation
         - Prior consultation triggers

      Return the structured JSON with all findings and a prioritised
      action plan.

  # Step 2, Generate a human-readable executive summary from the JSON findings.
  - id: executive_summary
    type: io.kestra.plugin.ai.agent.AIAgent
    description: Generate executive summary from structured audit findings
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
    configuration:
      temperature: 0.2
      maxToken: 4096
    systemMessage: |
      You are a GDPR compliance advisor writing an executive summary for
      senior management. Convert technical audit findings into clear,
      business-oriented language. Highlight regulatory risk, potential fines
      (referencing EDPB fine calculation guidelines), and business impact.
      Use Markdown formatting with clear sections.
    prompt: |
      Transform the following GDPR audit findings into an executive summary
      suitable for the board of directors and senior management:

      {{ outputs.audit_findings.textOutput }}

      Structure:
      ## Executive Summary
      2-3 paragraph overview of compliance posture.

      ## Overall Maturity Rating
      Visual indicator and explanation.

      ## Critical & High Priority Findings
      Table format: Area | Finding | Risk | Recommended Action | Timeline

      ## Regulatory Risk Assessment
      Potential fine exposure under EDPB calculation guidelines (considering
      turnover, nature of infringement, mitigating factors).

      ## Remediation Roadmap
      Phased plan: Immediate (0-4 weeks), Short-term (1-3 months),
      Medium-term (3-6 months).

  - id: log_findings
    type: io.kestra.plugin.core.log.Log
    message: |
      === STRUCTURED AUDIT FINDINGS (JSON) ===
      {{ outputs.audit_findings.textOutput }}

  - id: email_findings
    type: io.kestra.plugin.email.MailSend
    to: "{{ secret('DPO_EMAIL') }}"
    subject: "GDPR Compliance Audit, {{ inputs.audit_focus }}, {{ now() |
      date('yyyy-MM-dd') }}"
    htmlTextContent: |
      <h2>GDPR Compliance Audit Results</h2>
      <p><strong>Audit focus:</strong> {{ inputs.audit_focus }}</p>
      <hr>
      <h3>Executive Summary</h3>
      <pre>{{ outputs.executive_summary.textOutput }}</pre>
      <hr>
      <h3>Structured Findings (JSON)</h3>
      <pre>{{ outputs.audit_findings.textOutput }}</pre>

  - id: log_summary
    type: io.kestra.plugin.core.log.Log
    message: |
      === EXECUTIVE SUMMARY ===
      {{ outputs.executive_summary.textOutput }}

pluginDefaults:
  - type: io.kestra.plugin.ai.provider.MistralAI
    values:
      apiKey: "{{ secret('MISTRAL_API_KEY') }}"
      modelName: mistral-large-2512
  - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
    values:
      apiKey: "{{ secret('TAVILY_API_KEY') }}"
  - type: io.kestra.plugin.email.MailSend
    values:
      host: "{{ secret('SMTP_HOST') }}"
      port: 465
      username: "{{ secret('SMTP_USERNAME') }}"
      password: "{{ secret('SMTP_PASSWORD') }}"
      from: "{{ secret('LEGAL_TEAM_EMAIL') }}"

Run a comprehensive, AI-powered GDPR compliance audit that turns a plain description of your organization and data processing activities into both machine-readable findings (JSON) and a human-readable executive summary for senior management. It closes the gap between privacy programmes that live in scattered spreadsheets and a repeatable, automatable audit that references specific GDPR articles, accounts for previous findings, and grounds itself in the latest EDPB guidance pulled from live web search. The audit spans governance and accountability, lawfulness and consent, records of processing, data subject rights, security and breach readiness, international transfers, processor management, and the DPIA process.

How it works

The audit_findings task (io.kestra.plugin.ai.agent.AIAgent) takes your organization_context, audit_focus, and previous_findings inputs, retrieves current regulatory guidance via the io.kestra.plugin.ai.retriever.TavilyWebSearch content retriever, and returns findings constrained by a strict responseFormat JSON schema (maturity rating, per-area findings with GDPR references and priorities, and a prioritised action plan).
The executive_summary task (a second AIAgent) converts that JSON into board-oriented Markdown: compliance posture, maturity rating, a critical and high-priority findings table, regulatory risk assessment, and a phased remediation roadmap.
log_findings (io.kestra.plugin.core.log.Log) records the structured JSON in the execution logs.
email_findings (io.kestra.plugin.email.MailSend) emails the executive summary and JSON findings to the DPO.
log_summary (io.kestra.plugin.core.log.Log) logs the executive summary.

What you get

A validated JSON findings document ready for downstream automation.
A board-ready executive summary in Markdown with a risk assessment.
A prioritised, time-boxed remediation roadmap.
An automatic email to the DPO with both outputs.
Findings anchored to specific GDPR articles and current EDPB guidance.

Who it's for

Data Protection Officers and privacy teams running periodic audits.
Legal and compliance leads preparing board reports.
GRC and security teams feeding findings into tracking systems.
SaaS and B2B companies processing EU personal data.

Why orchestrate this with Kestra

Kestra runs this as declarative YAML you can version, review, and schedule, then triggers it on an event or cron so audits happen on a cadence rather than ad hoc. Task-level retries absorb transient AI provider or SMTP failures, and full execution lineage captures every input, prompt, and output for auditability (itself useful evidence in a compliance context). A standalone LLM chat or a SaaS GRC tool's built-in scheduler cannot chain a schema-constrained model call into a second summarization call, fan the result out to logs and email, and retry each step independently with full replay. Kestra coordinates the AI agents, the web retriever, and the notification side effects as one governed pipeline.

Prerequisites

A running Kestra instance with the AI and email plugins available.
A Mistral AI account (the flow uses mistral-large-2512).
A Tavily account for live web search.
An SMTP server for sending the audit email.

Secrets

MISTRAL_API_KEY: API key from the Mistral AI console.
TAVILY_API_KEY: API key from Tavily for retrieving current guidance.
SMTP_HOST, SMTP_USERNAME, SMTP_PASSWORD: SMTP server credentials.
LEGAL_TEAM_EMAIL: sender address for audit notifications.
DPO_EMAIL: recipient inbox for the audit results.

Quick start

Add this blueprint to your Kestra instance.
Configure the secrets listed above.
Execute the flow, editing organization_context, audit_focus, and previous_findings to match your organization.
Review the JSON findings in the logs and the executive summary in the DPO inbox.

How to extend

Parse the JSON findings and create a ticket per finding in Jira, Linear, or GitHub Issues.
Push results into a compliance dashboard or GRC platform.
Swap MistralAI for a local io.kestra.plugin.ai.provider.Ollama model for air-gapped, on-premise inference.
Add a schedule trigger to run weekly or monthly continuous monitoring.
Branch the focus area to run targeted audits for specific GDPR chapters.

Run an AI-Powered GDPR Compliance Audit with Structured Findings and Executive Summary

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

New to Kestra?

Run an AI-Powered GDPR Compliance Audit with Structured Findings and Executive Summary

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Share this Blueprint

Create a Blueprint

More AI Blueprints

Convert Natural Language Prompts to Structured Todoist Tasks with Deepseek AI

Generate and Send a Personalized AI-Powered Daily Digest Email Every Morning

Generate a book chapter summary using Perplexity AI and email it.

AI Annual Report Finder and Data Strategy Summary

Draft GDPR Breach Notifications for Supervisory Authorities and Data Subjects

Summarize Text with an AI Agent, Generate Multilingual Summaries in Short, Medium, or Long Format

New to Kestra?