Compliance Audit CLI

Run an NDPA 2023 compliance audit from the command line or CI with the ndpr binary

What the audit CLI does

The package ships an ndpr binary. ndpr auditscores a compliance config against the toolkit's engine — the compliance score plus the GAID 2025 DCPMI, Compliance Audit Returns, and breach-notification checks — and exits non-zero when the audit fails. Drop it into CI as a compliance gate.

A development gate, not a legal audit

The CLI measures the completeness of your declared compliance posture. It does not replace a Data Protection Impact Assessment or legal advice — verify against current NDPC guidance.

Usage

# with the toolkit installed, the `ndpr` bin is on your PATH:
npx ndpr audit --init        # writes ndpr.audit.json
npx ndpr audit               # run the audit (exit 1 on failure)
npx ndpr audit --min-score 80
npx ndpr audit --config compliance/ndpr.json
npx ndpr audit --json        # machine-readable result

# standalone (no install), use the scoped package name:
npx @tantainnovative/ndpr-toolkit audit --init

Flag	Effect
`--config <path>`	Path to the config (default `./ndpr.audit.json` or `./ndpr.config.json`)
`--min-score <n>`	Minimum overall compliance score to pass (default 70)
`--json`	Emit the full `NdprAuditResult` as JSON
`--init`	Write a starter `ndpr.audit.json` and exit
`--no-color`	Disable coloured output

The config file

The config is { minScore?, compliance, dcpmi?, car?, breaches? }. Only compliance is required; the rest enable the corresponding GAID 2025 checks.

{
  "minScore": 80,
  "compliance": {
    "consent": { "hasConsentMechanism": true, "hasPurposeSpecification": true, "hasWithdrawalMechanism": true, "hasMinorProtection": false, "consentRecordsRetained": true },
    "dsr": { "hasRequestMechanism": true, "supportsAccess": true, "supportsRectification": true, "supportsErasure": false, "supportsPortability": false, "supportsObjection": false, "responseTimelineDays": 30 },
    "dpia": { "conductedForHighRisk": true, "documentedRisks": true, "mitigationMeasures": true },
    "breach": { "hasNotificationProcess": true, "notifiesWithin72Hours": true, "hasRiskAssessment": true, "hasRecordKeeping": true },
    "policy": { "hasPrivacyPolicy": true, "isPubliclyAccessible": true, "lastUpdated": "2026-01-01", "coversAllSections": true },
    "lawfulBasis": { "documentedForAllProcessing": true, "hasLegitimateInterestAssessment": false },
    "crossBorder": { "hasTransferMechanisms": true, "adequacyAssessed": true, "ndpcApprovalObtained": false },
    "ropa": { "maintained": true, "includesAllProcessing": true, "lastReviewed": "2026-01-01" }
  },
  "dcpmi": { "dataSubjectsInSixMonths": 6200 },
  "car": { "commencementDate": "2025-01-15" }
}

Critical NDPA gaps and overdue breach notifications hard-fail the audit; high-priority gaps and approaching CAR deadlines produce warnings.

In CI

# .github/workflows/compliance.yml
name: NDPA compliance
on: [push, pull_request]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with: { node-version: 22 }
      - run: npx ndpr audit --min-score 80

Programmatic API

The same logic is exposed as pure, React-free functions from @tantainnovative/ndpr-toolkit/server:

import { runNdprAudit, formatNdprAuditReport } from '@tantainnovative/ndpr-toolkit/server';

const result = runNdprAudit({ compliance, dcpmi, car, breaches }, { minScore: 80 });
if (!result.passed) {
  console.error(formatNdprAuditReport(result));
  process.exit(1);
}