bmad-plus 0.9.0 → 0.9.2

package/src/bmad-plus/packs/pack-shield/references/lgpd/compliance-program.md

@@ -1,272 +1,272 @@
-# LGPD Compliance Programme Reference
-
-## Programme Template & Key Documents
-
----
-
-## 1. LGPD Compliance Roadmap
-
-### Phase 1 — Foundation (Months 1–3)
-- [ ] Appoint DPO (Encarregado) — publish contact on website
-- [ ] Conduct personal data inventory / data mapping
-- [ ] Identify all processing activities and responsible owners
-- [ ] Create Records of Processing Activities (RoPA)
-- [ ] Conduct initial LGPD gap assessment
-
-### Phase 2 — Remediation (Months 3–6)
-- [ ] Map legal basis to each processing activity (Arts. 7, 11)
-- [ ] Draft/update privacy notices (Art. 9)
-- [ ] Update consent mechanisms — ensure validity (Art. 8)
-- [ ] Implement data subject rights fulfilment procedures
-- [ ] Conduct Data Protection Impact Assessment (RIPD) for high-risk processing
-- [ ] Review and update supplier/processor contracts (Art. 39)
-- [ ] Implement security technical and administrative measures (Art. 46)
-- [ ] Establish international transfer compliance (Arts. 33–36)
-
-### Phase 3 — Operationalisation (Months 6–9)
-- [ ] Train all employees on LGPD obligations
-- [ ] Implement automated data subject request workflow
-- [ ] Establish breach detection and notification procedure (Art. 48)
-- [ ] Implement data retention and disposal schedule
-- [ ] Create internal LGPD governance committee
-- [ ] Conduct privacy by design review of new products/services
-
-### Phase 4 — Ongoing Compliance
-- [ ] Annual LGPD gap reassessment
-- [ ] RIPD for any new high-risk processing
-- [ ] Monitor ANPD guidance and resolution updates
-- [ ] Regular employee training refreshers
-- [ ] Annual DPO report to management
-- [ ] Incident response drills
-
----
-
-## 2. Records of Processing Activities (RoPA) Template
-
-*Per Art. 37 LGPD and ANPD Resolution No. 2/2022*
-
-| Field | Description |
-|-------|-------------|
-| Processing Activity Name | e.g., "Customer Account Management" |
-| Controller | Legal name, CNPJ |
-| DPO Contact | Name, email, phone |
-| Processor(s) | If applicable — name, CNPJ, role |
-| Purpose | Specific, legitimate purpose |
-| Legal Basis | Art. 7 or Art. 11 basis; if LI, balancing test reference |
-| Categories of Data | e.g., identification, financial, health, biometric |
-| Sensitive Data? | Yes/No; if yes, basis under Art. 11 |
-| Children's Data? | Yes/No; consent mechanism |
-| Data Subjects | Categories: customers, employees, suppliers, etc. |
-| Recipients/Sharing | Internal departments; external third parties |
-| International Transfers | Countries; transfer mechanism |
-| Retention Period | Duration; basis for retention or deletion |
-| Security Measures | Technical and administrative measures summary |
-| RIPD Reference | If DPIA/RIPD was conducted — reference number |
-| Last Updated | Date |
-
----
-
-## 3. Data Subject Request (DSR) Procedure
-
-### Step 1 — Receive
-- Provide accessible request channel (web form, email, in-person)
-- Log every request: date, requestor identity, type of request
-- Send acknowledgement within 1 business day
-
-### Step 2 — Verify Identity
-- Request minimum necessary identity proof (name + CPF + account reference)
-- Do not require excessive documentation — proportionate to risk
-- For requests on behalf of another: require valid power of attorney
-
-### Step 3 — Classify Request
-| Request Type | LGPD Article | Typical Response |
-|-------------|-------------|-----------------|
-| Confirmation of processing | Art. 18, I | Immediate (simplified) |
-| Access to data | Art. 18, II | 15 days (full report) |
-| Correction | Art. 18, III | Without undue delay |
-| Anonymisation/blocking/deletion | Art. 18, IV | Without undue delay |
-| Portability | Art. 18, V | ANPD format (pending) |
-| Deletion of consent-based data | Art. 18, VI | Without undue delay |
-| Information about sharing | Art. 18, VII | Without undue delay |
-| Consent denial consequences | Art. 18, VIII | Without undue delay |
-| Consent revocation | Art. 18, IX | Without undue delay |
-| Automated decision review | Art. 20 | Upon request |
-
-### Step 4 — Assess Exemptions
-Controller may decline if (Art. 18, §3º):
-- Data subject or third party would be harmed
-- National security
-- Financial intelligence or fiscal activities
-- Criminal/civil investigations
-- Economic or financial protection of public entity
-Must inform data subject of exemption applied and right to complain to ANPD.
-
-### Step 5 — Respond
-- Free of charge
-- Clear, accessible language
-- Immediate for simplified responses; 15 days for full access report
-- Log response and retain record
-
----
-
-## 4. Data Protection Impact Assessment (RIPD) Template
-
-*Relatório de Impacto à Proteção de Dados Pessoais — Art. 38 LGPD*
-
-### Section 1 — Processing Description
-- Name and purpose of processing activity
-- Legal basis (Art. 7 or Art. 11)
-- Categories of personal data and data subjects
-- Volume and frequency of processing
-- Systems and technologies used
-- Third parties involved (processors, sub-processors)
-- International transfers
-
-### Section 2 — Necessity and Proportionality Assessment
-- Is the processing necessary for the stated purpose?
-- Could the purpose be achieved with less data (necessity principle)?
-- Is the retention period proportionate?
-- Could anonymisation or pseudonymisation reduce risk?
-
-### Section 3 — Risk Identification
-| Risk | Likelihood | Impact | Risk Level |
-|------|-----------|--------|-----------|
-| Unauthorised access | High/Med/Low | High/Med/Low | High/Med/Low |
-| Data loss or deletion | ... | ... | ... |
-| Unlawful disclosure | ... | ... | ... |
-| Discriminatory use | ... | ... | ... |
-| Inaccurate data | ... | ... | ... |
-
-### Section 4 — Mitigation Measures
-For each identified risk:
-- Technical measure to be implemented
-- Administrative/process measure
-- Residual risk after mitigation
-- Responsible party and implementation date
-
-### Section 5 — DPO Opinion
-- DPO name and review date
-- DPO recommendation: Proceed / Proceed with conditions / Do not proceed
-- Conditions/recommendations if applicable
-
-### Section 6 — Management Approval
-- Controller representative signature and date
-- Decision: Proceed / Modify / Cancel processing
-
----
-
-## 5. Breach Notification Template
-
-### Preliminary ANPD Notification (within 3 working days)
-*ANPD Resolution CD/ANPD No. 15/2024*
-
-**Portal:** https://www.gov.br/anpd/pt-br/assuntos/incidentes-de-seguranca
-
-Fields required:
-- Controller identification (name, CNPJ, DPO contact)
-- Date incident detected; date notification submitted
-- Description of incident (what happened)
-- Approximate categories of data affected
-- Approximate number of data subjects affected
-- Immediate containment measures taken
-- Preliminary risk assessment
-
-### Full ANPD Report (within 20 working days)
-Additional fields:
-- Root cause analysis
-- Full scope of data affected (categories, volume)
-- Full list of systems/regions affected
-- All corrective and preventive measures implemented
-- Communication to data subjects (if required)
-- Updated risk assessment
-
-### Data Subject Notification (when required)
-Notify when: likely to cause significant harm to data subjects (Art. 48, §1º)
-
-Content:
-- Nature of the incident
-- What data was affected
-- Risks to the data subject
-- Measures taken by controller
-- Contact for questions (DPO)
-- How to exercise rights
-
----
-
-## 6. DPO (Encarregado) Job Description
-
-### Mandatory Functions (Art. 41, §2º)
-1. Accept complaints and communications from data subjects
-2. Receive communications from ANPD and take necessary action
-3. Guide employees and contractors on LGPD obligations
-4. Perform other duties defined by controller or ANPD
-
-### Recommended Additional Functions
-- Maintain and update RoPA
-- Coordinate DPIAs (RIPDs)
-- Monitor ANPD regulatory updates
-- Conduct or oversee LGPD training
-- Review new products/services for privacy compliance
-- Manage data subject rights requests
-- Coordinate breach response
-- Liaise with legal counsel on LGPD matters
-- Produce annual DPO report for management
-
-### DPO Publication Requirement (Art. 41, §1º)
-Controller must publish DPO identity and contact details — typically on:
-- Company website (privacy policy page)
-- Privacy notice / cookie notice
-- Any form collecting personal data
-
-### DPO Exemptions (ANPD Resolution No. 2/2022)
-Micro and small enterprises (ME/EPP) with low-risk processing activities may be exempt from mandatory DPO appointment, but must still designate a contact point for data subjects.
-
----
-
-## 7. LGPD Gap Assessment Checklist
-
-### Governance
-- [ ] DPO appointed and published (Art. 41)
-- [ ] LGPD policy approved by senior management
-- [ ] Privacy governance committee or equivalent
-- [ ] Annual LGPD review scheduled
-
-### Data Inventory
-- [ ] Personal data inventory complete
-- [ ] RoPA maintained and up to date (Art. 37)
-- [ ] Sensitive data identified and documented
-- [ ] Children's data identified and documented
-
-### Legal Basis
-- [ ] Legal basis documented for every processing activity
-- [ ] Sensitive data uses Art. 11 basis only
-- [ ] Legitimate interest balancing tests completed (Art. 10)
-- [ ] Consent records maintained (Art. 8)
-
-### Data Subject Rights
-- [ ] DSR intake mechanism in place (Art. 18)
-- [ ] Response within 15 days (access) / without undue delay (other rights)
-- [ ] Automated decisions review process (Art. 20)
-- [ ] Consent revocation mechanism (Art. 18, IX)
-
-### Vendors / Processors
-- [ ] Processor agreements include LGPD terms (Art. 39)
-- [ ] Sub-processor oversight documented
-- [ ] International transfers compliance (Arts. 33–36)
-
-### Security
-- [ ] Technical security measures implemented (Art. 46)
-- [ ] Administrative security measures implemented (Art. 46)
-- [ ] Privacy by design embedded in product development (Art. 49)
-- [ ] Breach detection and response procedure (Art. 48)
-- [ ] ANPD 3-day notification process documented
-
-### Transparency
-- [ ] Privacy notices published for all processing activities (Art. 9)
-- [ ] Cookie notice/consent tool (where applicable)
-- [ ] Children's consent mechanism (Art. 14)
-
-### High-Risk Processing
-- [ ] RIPD (DPIA) process established (Art. 38)
-- [ ] RIPDs completed for high-risk processing activities
-- [ ] Large-scale profiling assessed
+# LGPD Compliance Programme Reference
+
+## Programme Template & Key Documents
+
+---
+
+## 1. LGPD Compliance Roadmap
+
+### Phase 1 — Foundation (Months 1–3)
+- [ ] Appoint DPO (Encarregado) — publish contact on website
+- [ ] Conduct personal data inventory / data mapping
+- [ ] Identify all processing activities and responsible owners
+- [ ] Create Records of Processing Activities (RoPA)
+- [ ] Conduct initial LGPD gap assessment
+
+### Phase 2 — Remediation (Months 3–6)
+- [ ] Map legal basis to each processing activity (Arts. 7, 11)
+- [ ] Draft/update privacy notices (Art. 9)
+- [ ] Update consent mechanisms — ensure validity (Art. 8)
+- [ ] Implement data subject rights fulfilment procedures
+- [ ] Conduct Data Protection Impact Assessment (RIPD) for high-risk processing
+- [ ] Review and update supplier/processor contracts (Art. 39)
+- [ ] Implement security technical and administrative measures (Art. 46)
+- [ ] Establish international transfer compliance (Arts. 33–36)
+
+### Phase 3 — Operationalisation (Months 6–9)
+- [ ] Train all employees on LGPD obligations
+- [ ] Implement automated data subject request workflow
+- [ ] Establish breach detection and notification procedure (Art. 48)
+- [ ] Implement data retention and disposal schedule
+- [ ] Create internal LGPD governance committee
+- [ ] Conduct privacy by design review of new products/services
+
+### Phase 4 — Ongoing Compliance
+- [ ] Annual LGPD gap reassessment
+- [ ] RIPD for any new high-risk processing
+- [ ] Monitor ANPD guidance and resolution updates
+- [ ] Regular employee training refreshers
+- [ ] Annual DPO report to management
+- [ ] Incident response drills
+
+---
+
+## 2. Records of Processing Activities (RoPA) Template
+
+*Per Art. 37 LGPD and ANPD Resolution No. 2/2022*
+
+| Field | Description |
+|-------|-------------|
+| Processing Activity Name | e.g., "Customer Account Management" |
+| Controller | Legal name, CNPJ |
+| DPO Contact | Name, email, phone |
+| Processor(s) | If applicable — name, CNPJ, role |
+| Purpose | Specific, legitimate purpose |
+| Legal Basis | Art. 7 or Art. 11 basis; if LI, balancing test reference |
+| Categories of Data | e.g., identification, financial, health, biometric |
+| Sensitive Data? | Yes/No; if yes, basis under Art. 11 |
+| Children's Data? | Yes/No; consent mechanism |
+| Data Subjects | Categories: customers, employees, suppliers, etc. |
+| Recipients/Sharing | Internal departments; external third parties |
+| International Transfers | Countries; transfer mechanism |
+| Retention Period | Duration; basis for retention or deletion |
+| Security Measures | Technical and administrative measures summary |
+| RIPD Reference | If DPIA/RIPD was conducted — reference number |
+| Last Updated | Date |
+
+---
+
+## 3. Data Subject Request (DSR) Procedure
+
+### Step 1 — Receive
+- Provide accessible request channel (web form, email, in-person)
+- Log every request: date, requestor identity, type of request
+- Send acknowledgement within 1 business day
+
+### Step 2 — Verify Identity
+- Request minimum necessary identity proof (name + CPF + account reference)
+- Do not require excessive documentation — proportionate to risk
+- For requests on behalf of another: require valid power of attorney
+
+### Step 3 — Classify Request
+| Request Type | LGPD Article | Typical Response |
+|-------------|-------------|-----------------|
+| Confirmation of processing | Art. 18, I | Immediate (simplified) |
+| Access to data | Art. 18, II | 15 days (full report) |
+| Correction | Art. 18, III | Without undue delay |
+| Anonymisation/blocking/deletion | Art. 18, IV | Without undue delay |
+| Portability | Art. 18, V | ANPD format (pending) |
+| Deletion of consent-based data | Art. 18, VI | Without undue delay |
+| Information about sharing | Art. 18, VII | Without undue delay |
+| Consent denial consequences | Art. 18, VIII | Without undue delay |
+| Consent revocation | Art. 18, IX | Without undue delay |
+| Automated decision review | Art. 20 | Upon request |
+
+### Step 4 — Assess Exemptions
+Controller may decline if (Art. 18, §3º):
+- Data subject or third party would be harmed
+- National security
+- Financial intelligence or fiscal activities
+- Criminal/civil investigations
+- Economic or financial protection of public entity
+Must inform data subject of exemption applied and right to complain to ANPD.
+
+### Step 5 — Respond
+- Free of charge
+- Clear, accessible language
+- Immediate for simplified responses; 15 days for full access report
+- Log response and retain record
+
+---
+
+## 4. Data Protection Impact Assessment (RIPD) Template
+
+*Relatório de Impacto à Proteção de Dados Pessoais — Art. 38 LGPD*
+
+### Section 1 — Processing Description
+- Name and purpose of processing activity
+- Legal basis (Art. 7 or Art. 11)
+- Categories of personal data and data subjects
+- Volume and frequency of processing
+- Systems and technologies used
+- Third parties involved (processors, sub-processors)
+- International transfers
+
+### Section 2 — Necessity and Proportionality Assessment
+- Is the processing necessary for the stated purpose?
+- Could the purpose be achieved with less data (necessity principle)?
+- Is the retention period proportionate?
+- Could anonymisation or pseudonymisation reduce risk?
+
+### Section 3 — Risk Identification
+| Risk | Likelihood | Impact | Risk Level |
+|------|-----------|--------|-----------|
+| Unauthorised access | High/Med/Low | High/Med/Low | High/Med/Low |
+| Data loss or deletion | ... | ... | ... |
+| Unlawful disclosure | ... | ... | ... |
+| Discriminatory use | ... | ... | ... |
+| Inaccurate data | ... | ... | ... |
+
+### Section 4 — Mitigation Measures
+For each identified risk:
+- Technical measure to be implemented
+- Administrative/process measure
+- Residual risk after mitigation
+- Responsible party and implementation date
+
+### Section 5 — DPO Opinion
+- DPO name and review date
+- DPO recommendation: Proceed / Proceed with conditions / Do not proceed
+- Conditions/recommendations if applicable
+
+### Section 6 — Management Approval
+- Controller representative signature and date
+- Decision: Proceed / Modify / Cancel processing
+
+---
+
+## 5. Breach Notification Template
+
+### Preliminary ANPD Notification (within 3 working days)
+*ANPD Resolution CD/ANPD No. 15/2024*
+
+**Portal:** https://www.gov.br/anpd/pt-br/assuntos/incidentes-de-seguranca
+
+Fields required:
+- Controller identification (name, CNPJ, DPO contact)
+- Date incident detected; date notification submitted
+- Description of incident (what happened)
+- Approximate categories of data affected
+- Approximate number of data subjects affected
+- Immediate containment measures taken
+- Preliminary risk assessment
+
+### Full ANPD Report (within 20 working days)
+Additional fields:
+- Root cause analysis
+- Full scope of data affected (categories, volume)
+- Full list of systems/regions affected
+- All corrective and preventive measures implemented
+- Communication to data subjects (if required)
+- Updated risk assessment
+
+### Data Subject Notification (when required)
+Notify when: likely to cause significant harm to data subjects (Art. 48, §1º)
+
+Content:
+- Nature of the incident
+- What data was affected
+- Risks to the data subject
+- Measures taken by controller
+- Contact for questions (DPO)
+- How to exercise rights
+
+---
+
+## 6. DPO (Encarregado) Job Description
+
+### Mandatory Functions (Art. 41, §2º)
+1. Accept complaints and communications from data subjects
+2. Receive communications from ANPD and take necessary action
+3. Guide employees and contractors on LGPD obligations
+4. Perform other duties defined by controller or ANPD
+
+### Recommended Additional Functions
+- Maintain and update RoPA
+- Coordinate DPIAs (RIPDs)
+- Monitor ANPD regulatory updates
+- Conduct or oversee LGPD training
+- Review new products/services for privacy compliance
+- Manage data subject rights requests
+- Coordinate breach response
+- Liaise with legal counsel on LGPD matters
+- Produce annual DPO report for management
+
+### DPO Publication Requirement (Art. 41, §1º)
+Controller must publish DPO identity and contact details — typically on:
+- Company website (privacy policy page)
+- Privacy notice / cookie notice
+- Any form collecting personal data
+
+### DPO Exemptions (ANPD Resolution No. 2/2022)
+Micro and small enterprises (ME/EPP) with low-risk processing activities may be exempt from mandatory DPO appointment, but must still designate a contact point for data subjects.
+
+---
+
+## 7. LGPD Gap Assessment Checklist
+
+### Governance
+- [ ] DPO appointed and published (Art. 41)
+- [ ] LGPD policy approved by senior management
+- [ ] Privacy governance committee or equivalent
+- [ ] Annual LGPD review scheduled
+
+### Data Inventory
+- [ ] Personal data inventory complete
+- [ ] RoPA maintained and up to date (Art. 37)
+- [ ] Sensitive data identified and documented
+- [ ] Children's data identified and documented
+
+### Legal Basis
+- [ ] Legal basis documented for every processing activity
+- [ ] Sensitive data uses Art. 11 basis only
+- [ ] Legitimate interest balancing tests completed (Art. 10)
+- [ ] Consent records maintained (Art. 8)
+
+### Data Subject Rights
+- [ ] DSR intake mechanism in place (Art. 18)
+- [ ] Response within 15 days (access) / without undue delay (other rights)
+- [ ] Automated decisions review process (Art. 20)
+- [ ] Consent revocation mechanism (Art. 18, IX)
+
+### Vendors / Processors
+- [ ] Processor agreements include LGPD terms (Art. 39)
+- [ ] Sub-processor oversight documented
+- [ ] International transfers compliance (Arts. 33–36)
+
+### Security
+- [ ] Technical security measures implemented (Art. 46)
+- [ ] Administrative security measures implemented (Art. 46)
+- [ ] Privacy by design embedded in product development (Art. 49)
+- [ ] Breach detection and response procedure (Art. 48)
+- [ ] ANPD 3-day notification process documented
+
+### Transparency
+- [ ] Privacy notices published for all processing activities (Art. 9)
+- [ ] Cookie notice/consent tool (where applicable)
+- [ ] Children's consent mechanism (Art. 14)
+
+### High-Risk Processing
+- [ ] RIPD (DPIA) process established (Art. 38)
+- [ ] RIPDs completed for high-risk processing activities
+- [ ] Large-scale profiling assessed