Compliance and governance

Layers

Layers build on each other and each one works on its own: turn on the next layer when you want it, turn it off when you don't. Turning off deletes no data.

1. Base

   “Let me keep my list in order.”

   Obligations and policies

   • Obligations of 6 kinds, regulatory to contractual, recur monthly, quarterly or yearly; marking one done opens the next period
   • An open obligation past its due day turns overdue by itself and its owner is told
   • Policies in 9 areas, from security and quality to finance and HR, each with an owner, an effective date and a review date

2. Tracking

   “Let me not miss what happens when.”

   Data-protection notices and consent records

   • Privacy notices for 6 audiences, versioned: publishing a new version retires the old one, and a published text never changes
   • Consent by private link: the person sees the exact notice version, agrees, and can withdraw it later
   • A withdrawn consent is not deleted; its record stays with the day it was withdrawn

3. Process

   “Let the work follow a rule.”

   Data subject requests and the breach register; risks, controls and control-test evidence

   • Data subject requests of 5 types, due 30 days after receipt by default; reminders a week ahead and on the first overdue day
   • A breach register with a 72-hour countdown from detection; reminders when 24 hours are left and when time runs out
   • Risks are scored by probability and impact on a 3×3 matrix: low, medium, high or critical exposure
   • Controls with type, frequency and automation level; each test is recorded as pass, fail or partial with its evidence

4. Control

   “Let me manage it and account for it.”

   Processing inventory, processors and measures; findings with their evidence and verification

   • Findings of 5 types and 4 severities move from open through remediation to verified and closed; the fix opens a work item
   • A processing inventory: for each activity its purpose, legal ground, whose data, which categories, recipients and retention
   • Processors and sub-processors: a missing or expired data processing agreement, or a transfer abroad without its basis, is flagged