From 57418964b0c7148a622bf74a2ff8ce66c1eab0e9 Mon Sep 17 00:00:00 2001 From: ldastey-dev Date: Fri, 3 Jul 2026 23:12:24 +0100 Subject: [PATCH 1/2] =?UTF-8?q?fix(gdpr-playbook):=20correct=20standards?= =?UTF-8?q?=20cross-references=20in=20assessment=20=C2=A72.1-2.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The assessment matrix rows in playbooks/assess/gdpr.md pointed at the wrong standards/gdpr.md sections (systematic drift, unrelated to the cookie work): - 2.1 Principles: lawfulness/purpose->§2, minimisation->§3, accuracy->§5, storage limitation->§6, integrity & confidentiality->§7, accountability->§2 - 2.2 Data Subject Rights (all six): §2 -> §5 (Data Subject Rights) - 2.3 Technical measures: encryption/pseudonymisation/access control->§7, logging->§3 (no-PII-in-logs), breach detection->§10 Each reference now resolves to the section that actually contains the relevant requirement. The §2.4 International Transfers rows (§6 -> §9) are corrected separately in PR #20 to avoid overlapping edits. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- playbooks/assess/gdpr.md | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/playbooks/assess/gdpr.md b/playbooks/assess/gdpr.md index 6afc7d5..89bfeed 100644 --- a/playbooks/assess/gdpr.md +++ b/playbooks/assess/gdpr.md @@ -58,34 +58,34 @@ Evaluate the application against the GDPR requirements defined in `standards/gdp | Principle | What to evaluate | |---|---| -| Lawfulness, fairness, transparency | Verify each processing activity has a valid lawful basis per `standards/gdpr.md` §1. Assess whether privacy notices are clear and accessible. | -| Purpose limitation | Verify data is used only for its collected purpose per `standards/gdpr.md` §1. Check for secondary processing without additional basis. | -| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §1. Identify any over-collection. | -| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §1. Assess processes for keeping data current. | -| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §3. Check for data kept beyond its justified period. | -| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §4. | -| Accountability | Verify records of processing are maintained per `standards/gdpr.md` §5. Can the organisation demonstrate compliance? | +| Lawfulness, fairness, transparency | Verify each processing activity has a valid lawful basis per `standards/gdpr.md` §2. Assess whether privacy notices are clear and accessible. | +| Purpose limitation | Verify data is used only for its collected purpose per `standards/gdpr.md` §2. Check for secondary processing without additional basis. | +| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. | +| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. | +| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. | +| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. | +| Accountability | Verify records of processing are maintained per `standards/gdpr.md` §2. Can the organisation demonstrate compliance? | ### 2.2 Data Subject Rights (Articles 15-22) | Right | What to evaluate | |---|---| -| Access (Art. 15) | Verify the application can fulfil access requests per `standards/gdpr.md` §2. Can all personal data for a subject be retrieved in a structured format? | -| Rectification (Art. 16) | Verify correction capability across all stores per `standards/gdpr.md` §2. | -| Erasure (Art. 17) | Verify deletion capability per `standards/gdpr.md` §2. Assess cascading deletions and referential integrity handling. | -| Portability (Art. 20) | Verify export capability in machine-readable format per `standards/gdpr.md` §2. | -| Restriction (Art. 18) | Verify processing restriction capability per `standards/gdpr.md` §2. | -| Objection (Art. 21) | Verify objection capability for specific processing activities per `standards/gdpr.md` §2. | +| Access (Art. 15) | Verify the application can fulfil access requests per `standards/gdpr.md` §5. Can all personal data for a subject be retrieved in a structured format? | +| Rectification (Art. 16) | Verify correction capability across all stores per `standards/gdpr.md` §5. | +| Erasure (Art. 17) | Verify deletion capability per `standards/gdpr.md` §5. Assess cascading deletions and referential integrity handling. | +| Portability (Art. 20) | Verify export capability in machine-readable format per `standards/gdpr.md` §5. | +| Restriction (Art. 18) | Verify processing restriction capability per `standards/gdpr.md` §5. | +| Objection (Art. 21) | Verify objection capability for specific processing activities per `standards/gdpr.md` §5. | ### 2.3 Data Protection by Design (Article 25) | Aspect | What to evaluate | |---|---| -| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §4. | -| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §4. | -| Access control | Verify personal data access controls per `standards/gdpr.md` §4. | -| Logging | Verify access logging per `standards/gdpr.md` §4. Confirm logs themselves do not contain unmasked personal data. | -| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. | +| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. | +| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. | +| Access control | Verify personal data access controls per `standards/gdpr.md` §7. | +| Logging | Verify access logging per `standards/gdpr.md` §3. Confirm logs themselves do not contain unmasked personal data. | +| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §10. | ### 2.4 International Transfers (Chapter V) From dd77c2594594ada577fce8ab2f5555617e66e6ad Mon Sep 17 00:00:00 2001 From: ldastey-dev Date: Fri, 3 Jul 2026 23:31:41 +0100 Subject: [PATCH 2/2] =?UTF-8?q?fix(gdpr-playbook):=20anchor=20access-loggi?= =?UTF-8?q?ng=20requirement=20to=20=C2=A710?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 2.3 Logging row referenced only §3, which covers 'no personal data in logs' but not access logging itself. The requirement to log access to personal data stores lives in §10 (Breach Detection). Dual-reference the row: access logging per §10, no-PII-in-logs caveat per §3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- playbooks/assess/gdpr.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/playbooks/assess/gdpr.md b/playbooks/assess/gdpr.md index 89bfeed..b930df6 100644 --- a/playbooks/assess/gdpr.md +++ b/playbooks/assess/gdpr.md @@ -84,7 +84,7 @@ Evaluate the application against the GDPR requirements defined in `standards/gdp | Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. | | Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. | | Access control | Verify personal data access controls per `standards/gdpr.md` §7. | -| Logging | Verify access logging per `standards/gdpr.md` §3. Confirm logs themselves do not contain unmasked personal data. | +| Logging | Verify access logging per `standards/gdpr.md` §10. Confirm logs themselves do not contain unmasked personal data, per `standards/gdpr.md` §3. | | Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §10. | ### 2.4 International Transfers (Chapter V)