Most data-governance tooling makes a claim no one verifies: that it finds the violations. But how do you know an audit caught everything, when you don't know what was there to begin with? This project flips the usual approach — it manufactures a dataset with a known number of planted violations, so the audit can be graded against an answer key instead of taken on faith.
50,000 synthetic customer records generated with Faker, deliberately seeded with 4,447 known violations — retention-period breaches, unmasked PII, and consent gaps — spread across the dataset, giving an exact ground truth to measure detection against.
A layered audit: rule-based detectors for retention and consent violations, pattern scanners for unmasked PII (emails, card numbers, national IDs), and dbt models that apply and verify masking. Great Expectations enforces data-quality contracts, and a DuckDB query layer answers regulator-style requests — including a Subject Access Request lookup — on demand.
The audit caught 100% of the 4,447 seeded violations — including 847 unmasked PII patterns and roughly 2,400 retention breaches — with zero known misses against the answer key.
And a Subject Access Request, the query a regulator times you on, returns in 3.2 milliseconds: compliance that's not just correct but operationally fast.
Run this audit on a schedule against production extracts and alert on any non-zero violation count, so governance shifts from an annual scramble to a continuous control. The seeded-ground-truth pattern is worth keeping as a permanent test harness — it's the only way to prove the audit still works after every schema change.