fix(gdpr-playbook): correct standards cross-references in assessment matrix (§2.1–2.3) - #21
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR corrects section cross-references in the GDPR assessment playbook’s assessment matrix so evaluators are directed to the relevant parts of standards/gdpr.md.
Changes:
- Updated §2.1 principle rows to reference the intended GDPR standard sections (e.g., lawful basis → §2, retention → §6).
- Updated §2.2 data subject rights rows to consistently reference the DSAR section (§5).
- Updated §2.3 design-by-default rows to reference the relevant technical and breach sections (e.g., encryption → §7, breach detection → §10).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| | Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. | | ||
| | Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. | | ||
| | Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. | | ||
| | Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. | |
| | Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. | | ||
| | Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. | | ||
| | Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. | | ||
| | Accountability | Verify records of processing are maintained per `standards/gdpr.md` §2. Can the organisation demonstrate compliance? | |
| | Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. | | ||
| | Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. | | ||
| | Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. | | ||
| | Access control | Verify personal data access controls per `standards/gdpr.md` §7. | |
| | Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. | | ||
| | Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. | | ||
| | Access control | Verify personal data access controls per `standards/gdpr.md` §7. | | ||
| | Logging | Verify access logging per `standards/gdpr.md` §3. Confirm logs themselves do not contain unmasked personal data. | |
…§2.1-2.3 The assessment matrix rows in playbooks/assess/gdpr.md pointed at the wrong standards/gdpr.md sections (systematic drift, unrelated to the cookie work): - 2.1 Principles: lawfulness/purpose->§2, minimisation->§3, accuracy->§5, storage limitation->§6, integrity & confidentiality->§7, accountability->§2 - 2.2 Data Subject Rights (all six): §2 -> §5 (Data Subject Rights) - 2.3 Technical measures: encryption/pseudonymisation/access control->§7, logging->§3 (no-PII-in-logs), breach detection->§10 Each reference now resolves to the section that actually contains the relevant requirement. The §2.4 International Transfers rows (§6 -> §9) are corrected separately in PR #20 to avoid overlapping edits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
ldastey-dev
force-pushed
the
fix/gdpr-playbook-cross-references
branch
from
July 3, 2026 22:26
79c38e2 to
5741896
Compare
The 2.3 Logging row referenced only §3, which covers 'no personal data in logs' but not access logging itself. The requirement to log access to personal data stores lives in §10 (Breach Detection). Dual-reference the row: access logging per §10, no-PII-in-logs caveat per §3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
| | Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. | | ||
| | Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. | | ||
| | Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. | | ||
| | Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. | |
| | Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. | | ||
| | Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. | | ||
| | Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. | | ||
| | Access control | Verify personal data access controls per `standards/gdpr.md` §7. | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes systematic cross-reference drift in the GDPR assessment playbook. The assessment matrix in
playbooks/assess/gdpr.md(§2.1–2.3) pointed at the wrongstandards/gdpr.mdsections — e.g. the Data Subject Rights rows all cited §2 (Lawful Basis) instead of §5 (Data Subject Rights), and breach detection cited §5 instead of §10.This drift is pre-existing and unrelated to any feature work; it was surfaced while reviewing the cookie-declaration PR (#20).
Corrections
Notes