Skip to content

fix(gdpr-playbook): correct standards cross-references in assessment matrix (§2.1–2.3) - #21

Merged
ldastey-dev merged 2 commits into
mainfrom
fix/gdpr-playbook-cross-references
Jul 3, 2026
Merged

fix(gdpr-playbook): correct standards cross-references in assessment matrix (§2.1–2.3)#21
ldastey-dev merged 2 commits into
mainfrom
fix/gdpr-playbook-cross-references

Conversation

@ldastey-dev

Copy link
Copy Markdown
Owner

Summary

Fixes systematic cross-reference drift in the GDPR assessment playbook. The assessment matrix in playbooks/assess/gdpr.md (§2.1–2.3) pointed at the wrong standards/gdpr.md sections — e.g. the Data Subject Rights rows all cited §2 (Lawful Basis) instead of §5 (Data Subject Rights), and breach detection cited §5 instead of §10.

This drift is pre-existing and unrelated to any feature work; it was surfaced while reviewing the cookie-declaration PR (#20).

Corrections

Row(s) Was Now Rationale
2.1 Lawfulness, Purpose limitation §1 §2 Lawful Basis & Purpose Limitation
2.1 Data minimisation §1 §3 Data Minimisation
2.1 Accuracy §1 §5 Rectification (Art. 16) lives under Data Subject Rights
2.1 Storage limitation §3 §6 Retention & Deletion
2.1 Integrity and confidentiality §4 §7 Encryption & Pseudonymisation
2.1 Accountability §5 §2 Documented processing / lawful-basis records
2.2 all six subject rights §2 §5 Data Subject Rights (DSAR)
2.3 Encryption / Pseudonymisation / Access control §4 §7 Encryption & Pseudonymisation (technical measures)
2.3 Logging §4 §3 "No personal data in logs" requirement is in §3
2.3 Breach detection §5 §10 Breach Detection & Notification

Notes

  • A few rows (accuracy, accountability, access control, logging) have no single dedicated section in the standard; each has been anchored to the section that most directly contains the relevant requirement, as explained above.
  • The §2.4 International Transfers rows (§6 → §9) are corrected separately in feat: cookie declaration #20 to keep the two changes non-overlapping. This PR deliberately leaves §2.4 untouched.
  • Content-only change to one playbook file; no standards, deploy scripts, or skill wrappers affected.

Copilot AI review requested due to automatic review settings July 3, 2026 22:12

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR corrects section cross-references in the GDPR assessment playbook’s assessment matrix so evaluators are directed to the relevant parts of standards/gdpr.md.

Changes:

  • Updated §2.1 principle rows to reference the intended GDPR standard sections (e.g., lawful basis → §2, retention → §6).
  • Updated §2.2 data subject rights rows to consistently reference the DSAR section (§5).
  • Updated §2.3 design-by-default rows to reference the relevant technical and breach sections (e.g., encryption → §7, breach detection → §10).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread playbooks/assess/gdpr.md
| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. |
| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. |
| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. |
| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. |
Comment thread playbooks/assess/gdpr.md
| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. |
| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. |
| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. |
| Accountability | Verify records of processing are maintained per `standards/gdpr.md` §2. Can the organisation demonstrate compliance? |
Comment thread playbooks/assess/gdpr.md
| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. |
| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. |
| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. |
| Access control | Verify personal data access controls per `standards/gdpr.md` §7. |
Comment thread playbooks/assess/gdpr.md Outdated
| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. |
| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. |
| Access control | Verify personal data access controls per `standards/gdpr.md` §7. |
| Logging | Verify access logging per `standards/gdpr.md` §3. Confirm logs themselves do not contain unmasked personal data. |
…§2.1-2.3

The assessment matrix rows in playbooks/assess/gdpr.md pointed at the wrong
standards/gdpr.md sections (systematic drift, unrelated to the cookie work):

- 2.1 Principles: lawfulness/purpose->§2, minimisation->§3, accuracy->§5,
  storage limitation->§6, integrity & confidentiality->§7, accountability->§2
- 2.2 Data Subject Rights (all six): §2 -> §5 (Data Subject Rights)
- 2.3 Technical measures: encryption/pseudonymisation/access control->§7,
  logging->§3 (no-PII-in-logs), breach detection->§10

Each reference now resolves to the section that actually contains the relevant
requirement. The §2.4 International Transfers rows (§6 -> §9) are corrected
separately in PR #20 to avoid overlapping edits.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@ldastey-dev
ldastey-dev force-pushed the fix/gdpr-playbook-cross-references branch from 79c38e2 to 5741896 Compare July 3, 2026 22:26
The 2.3 Logging row referenced only §3, which covers 'no personal data in
logs' but not access logging itself. The requirement to log access to personal
data stores lives in §10 (Breach Detection). Dual-reference the row: access
logging per §10, no-PII-in-logs caveat per §3.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 3, 2026 22:31

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Comment thread playbooks/assess/gdpr.md
| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. |
| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. |
| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. |
| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. |
Comment thread playbooks/assess/gdpr.md
| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. |
| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. |
| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. |
| Access control | Verify personal data access controls per `standards/gdpr.md` §7. |
@ldastey-dev
ldastey-dev merged commit aa1131f into main Jul 3, 2026
1 check passed
@ldastey-dev
ldastey-dev deleted the fix/gdpr-playbook-cross-references branch July 3, 2026 22:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants