GDPR Data Residency Auditor: Automated IaC & Multi-Cloud Com

Phase 0 gate passed: working directory readable, no git root (recorded as null).

Phase 1 result — targets (3, deduplicated, no exclusions matched):
./terraform/main.tf, ./k8s/deployment.yaml, ./config/pipeline.env

Empty-repo guard: not triggered (targets non-empty). Proceeding to Phase 2.

Phase 2 confirmed: zero transfer-mechanism tokens (SCC/BCR/DPF/derogation/home_region) anywhere in the three files — this rules out AT_RISK/COMPLIANT via mechanism and rules out any inferred home_region for source-jurisdiction. Now writing Phase 3 classification and Phase 4 artifacts.

Audit summary — 3 files scanned, 7 signals extracted, 4 findings (2 VIOLATION/high, 2 NEEDS_HUMAN_REVIEW/low), status FAIL:

RES-001 (terraform/main.tf:11) — S3 replication from eu-central-1 to us-east-1, no transfer mechanism → VIOLATION.
RES-002 (k8s/deployment.yaml:15) — declared DATA_RESIDENCY=eu-central-1 but endpoint hits us-east-1 → VIOLATION.
RES-003 / RES-004 (config/pipeline.env:1,3) — ap-south-1 (non-adequate), no mechanism, DATA_CATEGORY=special_category explicit in-file — but pipeline.env has no source-jurisdiction signal of its own, so per the skill's decision tree these stay NEEDS_HUMAN_REVIEW rather than being forced into VIOLATION.

Special-category override, shown explicitly: for RES-003/004, the report states that if a reviewer confirms EU sourcing, the base result would be VIOLATION (personal → high), and because DATA_CATEGORY=special_category is declared on line 2 of that file, Section 4's override rule (VIOLATION → VIOLATION, severity critical) would then fire — bumping severity from high to critical without changing the classification. I applied this only as a conditional note rather than baking it into the recorded classification, since the auditor's hard rules forbid inferring source jurisdiction that isn't textually present in that file.

GDPR Data Residency Audit

Working directory: /home/claude/gdpr_audit
Git root: null (NO_GIT_ROOT)
Scan time (UTC): 2026-09-19T00:00:00Z
Files scanned: 3
Signals extracted: 7
Findings: 4 (critical: 0, high: 2, medium: 0, low: 2, info: 0)
Status: FAIL

Targets discovered (Phase 1)

• ./terraform/main.tf
• ./k8s/deployment.yaml
• ./config/pipeline.env

Signals extracted (Phase 2)

Findings

RES-001 — VIOLATION — high

• File: terraform/main.tf:11
• Evidence: region = "us-east-1"
• Attribute: region
• Source → Destination: DE (eu-central-1) → US (us-east-1)
• Data category: personal (inferred from resource naming: customer_data, bucket customer-data-eu)
• Mechanism detected: none

Rationale: The aws_s3_bucket.customer_data resource declares its own region as eu-central-1 (line 3, same file), and its replication configuration (lines 6–13) targets a destination bucket in us-east-1. No adequacy, DPF certification, SCC, BCR, or derogation token was found anywhere in the scanned files, so this cross-border transfer breaches GDPR Art. 44.

RES-002 — VIOLATION — high

• File: k8s/deployment.yaml:15
• Evidence: value: "https://analytics.company.us-east-1.amazonaws.com"
• Attribute: endpoint
• Source → Destination: EU (eu-central-1, declared via DATA_RESIDENCY at line 17) → US (us-east-1)
• Data category: personal (metadata label data-category: personal-data, line 6)
• Mechanism detected: none

Rationale: The deployment declares DATA_RESIDENCY=eu-central-1 (line 17) but the container's ANALYTICS_ENDPOINT (line 15) points to a us-east-1 AWS endpoint — the declared residency and the actual processing endpoint conflict. No transfer mechanism token was found in this file or elsewhere in the scanned set, so this breaches GDPR Art. 44.

RES-003 — NEEDS_HUMAN_REVIEW — low

• File: config/pipeline.env:1
• Evidence: BACKUP_REGION=ap-south-1
• Attribute: replication (backup_region)
• Source → Destination: UNKNOWN_SOURCE → IN (ap-south-1)
• Data category: special_category (explicit DATA_CATEGORY=special_category, line 2, same file)
• Mechanism detected: none

Rationale: config/pipeline.env contains no source-region, data_residency, or home_region signal, and is not under a path containing eu/ or emea/. Per the classification rule, source jurisdiction cannot be confirmed as EU/EEA from this file alone, so the decision tree exits at step 1 with NEEDS_HUMAN_REVIEW rather than a hard classification.

Conditional note (not asserted as fact): if a human reviewer confirms this pipeline sources EU personal data (it sits alongside customer-data-eu and DATA_RESIDENCY=eu-central-1 elsewhere in this same audit), the destination ap-south-1 (India) is NOT_ADEQUATE per §3.2, no mechanism is declared, so the base classification would be VIOLATION (personal → high). Because DATA_CATEGORY=special_category is explicitly declared on line 2 of this same file, the special-category override in Section 4 would then apply: VIOLATION → VIOLATION (severity critical). This escalation is

not applied to the recorded classification below because source jurisdiction was not confirmed from this file — it is presented only to show how the override rule would fire if human review confirms the source.

RES-004 — NEEDS_HUMAN_REVIEW — low

• File: config/pipeline.env:3
• Evidence: EXPORT_ENDPOINT=https://ml-service.ap-south-1.amazonaws.com
• Attribute: endpoint
• Source → Destination: UNKNOWN_SOURCE → IN (ap-south-1)
• Data category: special_category (explicit DATA_CATEGORY=special_category, line 2, same file)
• Mechanism detected: none

Rationale: Same as RES-003: no source-jurisdiction signal exists in this file, so this finding is held at NEEDS_HUMAN_REVIEW. If EU sourcing is confirmed by a reviewer, this endpoint corroborates RES-003's destination (ap-south-1, non-adequate, no mechanism) and would be subject to the same special-category escalation described above.

Excluded paths

(none — no paths matched the exclusion globs: node_modules/, .git/, vendor/, dist/, build/, .terraform/, target/)

Errors

none

---

This report is a technical signal for DPO/counsel review. It is not legal advice.

flowchart LR

  DE["eu-central-1 (DE)\nterraform/main.tf:3"] -->|"personal data"| US1["us-east-1 (US)\nterraform/main.tf:11"]
  EU2["eu-central-1 (EU, DATA_RESIDENCY)\nk8s/deployment.yaml:17"] -->|"personal data"| US2["us-east-1 (US)\nk8s/deployment.yaml:15"]
  UNK["UNKNOWN_SOURCE\nconfig/pipeline.env"] -->|"special_category data"| IN1["ap-south-1 (IN)\nconfig/pipeline.env:1"]
  UNK -->|"special_category data"| IN2["ap-south-1 (IN)\nconfig/pipeline.env:3"]

classDef violation fill:#fdd,stroke:#900,stroke-width:2px
classDef atrisk fill:#ffd,stroke:#990,stroke-width:2px
classDef review fill:#eee,stroke:#666,stroke-width:2px,stroke-dasharray: 4 2
classDef compliant fill:#dfd,stroke:#090

  class US1 violation
  class US2 violation
  class IN1 review
  class IN2 review

--- a/terraform/main.tf
+++ b/terraform/main.tf

@@ -8,6 +8,6 @@ resource "aws_s3_bucket_replication_configuration" "customer_data_replica" {
   rule {
     destination {

•  bucket = "arn:aws:s3:::customer-data-us-east-1"
  

•  region = "us-east-1"
  

•  bucket = "arn:aws:s3:::customer-data-eu-central-1"
  

•  region = "eu-central-1"
  

     }
   }
 }

--- a/k8s/deployment.yaml
+++ b/k8s/deployment.yaml
@@ -12,7 +12,7 @@ spec:
- name: ANALYTICS_ENDPOINT

•      value: "https://analytics.company.us-east-1.amazonaws.com"
  

•      value: "https://analytics.company.eu-central-1.amazonaws.com"
     - name: DATA_RESIDENCY
       value: "eu-central-1"
  

RECOMMENDATION for RES-003

File: config/pipeline.env:1
Issue: BACKUP_REGION points to ap-south-1 (India), which is not on the EU adequacy list (§3.2), and no transfer mechanism (SCC/BCR/DPF/derogation) is declared anywhere in the scanned files. Source jurisdiction could not be confirmed as EU/EEA from this file, so a rewrite cannot be safely auto-generated.
Action: A human reviewer should confirm whether this pipeline processes EU personal data. If confirmed, either (a) point BACKUP_REGION at an EU region (e.g. eu-central-1), or (b) execute Standard Contractual Clauses with the India-based processor and complete a Transfer Impact Assessment before this backup runs, given DATA_CATEGORY=special_category on line 2 escalates severity to critical once confirmed.
Verify: grep -n "ap-south-1" config/pipeline.env returns nothing (if migrated) or an SCC/derogation token is present in repo config (if mechanism-based).

RECOMMENDATION for RES-004

File: config/pipeline.env:3
Issue: EXPORT_ENDPOINT points to a ml-service.ap-south-1.amazonaws.com endpoint, corroborating the RES-003 transfer with the same non-adequate destination and unconfirmed source.
Action: Same as RES-003 — confirm source jurisdiction, then either move the endpoint to an EU-region host or attach a lawful transfer mechanism.
Verify: grep -n "ap-south-1" config/pipeline.env returns nothing (if migrated) or a documented mechanism is present.