Skip to content

fix(gdpr-playbook): correct standards cross-references in assessment matrix (§2.1–2.3) #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ldastey-dev merged 2 commits into from
Jul 3, 2026
Merged

fix(gdpr-playbook): correct standards cross-references in assessment matrix (§2.1–2.3) #21

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5741896
fix(gdpr-playbook): correct standards cross-references in assessment …
ldastey-dev Jul 3, 2026
dd77c25
fix(gdpr-playbook): anchor access-logging requirement to §10
ldastey-dev Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 18 additions & 18 deletions playbooks/assess/gdpr.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,34 +58,34 @@ Evaluate the application against the GDPR requirements defined in `standards/gdp

| Principle | What to evaluate |
|---|---|
| Lawfulness, fairness, transparency | Verify each processing activity has a valid lawful basis per `standards/gdpr.md` §1. Assess whether privacy notices are clear and accessible. |
| Purpose limitation | Verify data is used only for its collected purpose per `standards/gdpr.md` §1. Check for secondary processing without additional basis. |
| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §1. Identify any over-collection. |
| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §1. Assess processes for keeping data current. |
| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §3. Check for data kept beyond its justified period. |
| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §4. |
| Accountability | Verify records of processing are maintained per `standards/gdpr.md` §5. Can the organisation demonstrate compliance? |
| Lawfulness, fairness, transparency | Verify each processing activity has a valid lawful basis per `standards/gdpr.md` §2. Assess whether privacy notices are clear and accessible. |
| Purpose limitation | Verify data is used only for its collected purpose per `standards/gdpr.md` §2. Check for secondary processing without additional basis. |
| Data minimisation | Evaluate collection against the minimisation requirements in `standards/gdpr.md` §3. Identify any over-collection. |
| Accuracy | Verify correction mechanisms exist per `standards/gdpr.md` §5. Assess processes for keeping data current. |
| Storage limitation | Verify retention periods are defined and enforced per `standards/gdpr.md` §6. Check for data kept beyond its justified period. |
| Integrity and confidentiality | Evaluate technical measures against the encryption and access control requirements in `standards/gdpr.md` §7. |
| Accountability | Verify records of processing are maintained per `standards/gdpr.md` §2. Can the organisation demonstrate compliance? |

### 2.2 Data Subject Rights (Articles 15-22)

| Right | What to evaluate |
|---|---|
| Access (Art. 15) | Verify the application can fulfil access requests per `standards/gdpr.md` §2. Can all personal data for a subject be retrieved in a structured format? |
| Rectification (Art. 16) | Verify correction capability across all stores per `standards/gdpr.md` §2. |
| Erasure (Art. 17) | Verify deletion capability per `standards/gdpr.md` §2. Assess cascading deletions and referential integrity handling. |
| Portability (Art. 20) | Verify export capability in machine-readable format per `standards/gdpr.md` §2. |
| Restriction (Art. 18) | Verify processing restriction capability per `standards/gdpr.md` §2. |
| Objection (Art. 21) | Verify objection capability for specific processing activities per `standards/gdpr.md` §2. |
| Access (Art. 15) | Verify the application can fulfil access requests per `standards/gdpr.md` §5. Can all personal data for a subject be retrieved in a structured format? |
| Rectification (Art. 16) | Verify correction capability across all stores per `standards/gdpr.md` §5. |
| Erasure (Art. 17) | Verify deletion capability per `standards/gdpr.md` §5. Assess cascading deletions and referential integrity handling. |
| Portability (Art. 20) | Verify export capability in machine-readable format per `standards/gdpr.md` §5. |
| Restriction (Art. 18) | Verify processing restriction capability per `standards/gdpr.md` §5. |
| Objection (Art. 21) | Verify objection capability for specific processing activities per `standards/gdpr.md` §5. |

### 2.3 Data Protection by Design (Article 25)

| Aspect | What to evaluate |
|---|---|
| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §4. |
| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §4. |
| Access control | Verify personal data access controls per `standards/gdpr.md` §4. |
| Logging | Verify access logging per `standards/gdpr.md` §4. Confirm logs themselves do not contain unmasked personal data. |
| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §5. |
| Encryption | Verify encryption at rest and in transit meets the requirements in `standards/gdpr.md` §7. |
| Pseudonymisation | Assess whether pseudonymisation is applied where full identification is not required, per `standards/gdpr.md` §7. |
| Access control | Verify personal data access controls per `standards/gdpr.md` §7. |
| Logging | Verify access logging per `standards/gdpr.md` §10. Confirm logs themselves do not contain unmasked personal data, per `standards/gdpr.md` §3. |
| Breach detection | Verify breach detection and 72-hour notification capability per `standards/gdpr.md` §10. |

### 2.4 International Transfers (Chapter V)

Expand Down