arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-rgpd-template.md

@@ -0,0 +1,198 @@
+# GDPR Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-rgpd`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-rgpd` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Area | Status | Key Findings |
+|------|--------|-------------|
+| Lawful Basis | [Established / Partial / Gap] | [Summary] |
+| Data Subject Rights | [Implemented / Partial / Gap] | [Summary] |
+| International Transfers | [Compliant / Partial / Gap] | [Summary] |
+| DPIA Requirement | [Required / Not required / Conducted] | [Summary] |
+| DPO | [Designated / Not required / Gap] | [Summary] |
+| Breach Notification | [Process in place / Gap] | [Summary] |
+
+---
+
+## 1. Scope and Role Determination
+
+### 1.1 Role of the Organisation
+
+| Role | Definition | Applicable |
+|------|-----------|-----------|
+| **Data Controller** | Determines purposes and means of processing | ☐ |
+| **Data Processor** | Processes on behalf of a controller | ☐ |
+| **Joint Controller** | Jointly determines purposes and means with another entity | ☐ |
+| **Sub-processor** | Engaged by a processor | ☐ |
+
+### 1.2 Data Categories Processed
+
+| Data Category | GDPR Reference | Present in System | Lawful Basis |
+|--------------|---------------|------------------|-------------|
+| Standard personal data | Art. 6 | ☐ | [Article 6(1)(?) basis] |
+| Special category data | Art. 9 | ☐ | [Article 9(2)(?) condition] |
+| — Health data | Art. 9(1) | ☐ | |
+| — Biometric data (for ID purposes) | Art. 9(1) | ☐ | |
+| — Genetic data | Art. 9(1) | ☐ | |
+| — Racial/ethnic origin | Art. 9(1) | ☐ | |
+| — Political opinions | Art. 9(1) | ☐ | |
+| — Religious/philosophical beliefs | Art. 9(1) | ☐ | |
+| — Trade union membership | Art. 9(1) | ☐ | |
+| — Sexual orientation/sex life | Art. 9(1) | ☐ | |
+| Criminal conviction data | Art. 10 | ☐ | |
+
+## 2. Lawful Basis Assessment
+
+### 2.1 Article 6 Basis Mapping (Standard Personal Data)
+
+| Processing Activity | Data Subjects | Lawful Basis (Art. 6(1)) | Rationale |
+|--------------------|--------------|--------------------------|-----------|
+| [Activity 1] | [Category] | [a/b/c/d/e/f] | [Explanation] |
+| [Activity 2] | [Category] | [a/b/c/d/e/f] | [Explanation] |
+
+Lawful basis codes: (a) Consent | (b) Contract | (c) Legal obligation | (d) Vital interests | (e) Public task | (f) Legitimate interests
+
+### 2.2 Article 9 Conditions (Special Category Data)
+
+| Processing Activity | Special Category | Article 9(2) Condition | Safeguards |
+|--------------------|----------------|----------------------|-----------|
+| [Activity] | [Category] | [Condition letter] | [Safeguards in place] |
+
+### 2.3 Consent Management (if applicable)
+
+| Requirement | Status |
+|-------------|--------|
+| Consent freely given, specific, informed, unambiguous | ☐ |
+| Withdrawal as easy as giving | ☐ |
+| Consent records maintained | ☐ |
+| Consent age-appropriate (member state minimum) | ☐ |
+| Consent not bundled with unrelated conditions | ☐ |
+
+## 3. Privacy by Design and Default (Article 25)
+
+| Principle | Implementation | Status |
+|-----------|---------------|--------|
+| Data minimisation — collect only what is necessary | [Description] | ☐ |
+| Purpose limitation — use only for stated purposes | [Description] | ☐ |
+| Storage limitation — retain only as long as necessary | [Description] | ☐ |
+| Pseudonymisation applied where possible | [Description] | ☐ |
+| Privacy-friendly defaults (most private settings by default) | [Description] | ☐ |
+| Data protection integrated in system design | [Description] | ☐ |
+
+## 4. Data Subject Rights (Articles 15–22)
+
+| Right | Article | Mechanism Implemented | Response Time | Status |
+|-------|---------|----------------------|--------------|--------|
+| Right of access (SAR) | 15 | [Description] | 1 month | ☐ |
+| Right to rectification | 16 | [Description] | 1 month | ☐ |
+| Right to erasure | 17 | [Description] | 1 month | ☐ |
+| Right to restriction | 18 | [Description] | Notify before lifting | ☐ |
+| Right to portability | 20 | [Description] | 1 month | ☐ |
+| Right to object | 21 | [Description] | Immediately | ☐ |
+| Rights re: automated decisions | 22 | [Description] | — | ☐ |
+
+## 5. Records of Processing Activities (Article 30)
+
+| Requirement | Status |
+|-------------|--------|
+| RoPA (Record of Processing Activities) maintained | ☐ |
+| RoPA includes all mandatory fields (Art. 30) | ☐ |
+| RoPA kept up to date | ☐ |
+| RoPA available to supervisory authority on request | ☐ |
+
+**RoPA location**: [File path / system name]
+
+## 6. Data Protection Impact Assessment (Article 35)
+
+### 6.1 DPIA Triggers
+
+| Trigger | Present | Assessment |
+|---------|---------|-----------|
+| Systematic and extensive profiling with significant effects | ☐ | |
+| Large-scale processing of special category data | ☐ | |
+| Systematic monitoring of public areas | ☐ | |
+| Other high-risk processing (EDPB list) | ☐ | |
+
+**DPIA Required**: ☐ Yes ☐ No
+
+### 6.2 DPIA Status
+
+| DPIA | Conducted | Date | Outcome |
+|------|-----------|------|---------|
+| [Processing activity] | ☐ | [Date] | [Summary] |
+
+## 7. Data Processors and Sub-Processors (Article 28)
+
+| Processor | Service | DPA in Place | Binding Commitments | Review Date |
+|-----------|---------|-------------|---------------------|------------|
+| [Provider] | [Service] | ☐ | ☐ | [Date] |
+
+Data Processing Agreement (DPA) must include:
+
+- [ ] Processing only on controller's instructions
+- [ ] Confidentiality obligations on authorised persons
+- [ ] Appropriate security measures (Article 32)
+- [ ] Sub-processor controls and notification
+- [ ] Assistance with data subject rights
+- [ ] Deletion/return on contract end
+- [ ] Audit cooperation
+
+## 8. International Transfers (Articles 44–49)
+
+| Transfer | Destination Country | Adequacy Decision | Safeguard | Transfer Impact Assessment | Status |
+|----------|--------------------|--------------------|-----------|--------------------------|--------|
+| [Data type] | [Country] | ☐ Yes ☐ No | [SCC / BCR / Art. 49 derogation] | ☐ Conducted | ☐ |
+
+## 9. Breach Notification (Articles 33–34)
+
+| Requirement | Deadline | Recipient | Status |
+|-------------|---------|-----------|--------|
+| Notification to supervisory authority | **72 hours** | Lead DPA | ☐ |
+| Notification to data subjects (if high risk) | Without undue delay | Affected individuals | ☐ |
+| Breach documented in internal register | Ongoing | Internal | ☐ |
+
+**Breach notification process in place**: ☐ Yes ☐ No
+
+## 10. National Supervisory Authority Context
+
+| Member State | Supervisory Authority | National Specificities |
+|-------------|----------------------|----------------------|
+| France | CNIL | Age of consent: 15; digital legacy rights; Délibération cookies 2020-091. See `/arckit:fr-rgpd` |
+| Germany | BfDI + 16 Länder DPAs | Federal structure; stricter employee data rules |
+| Netherlands | AP | Strict enforcement on cookies and scoping |
+| Spain | AGPD | Specific requirements for public sector |
+| Italy | Garante | Additional provisions on profiling |
+| Belgium | APD | Enforcement on legitimate interests |
+| Ireland | DPC | Lead DPA for major tech companies |
+| Sweden | IMY | Strong anonymisation requirements |
+| [Other] | [Authority] | [Specificities] |
+
+> **Note**: For French deployments, run `/arckit:fr-rgpd` to cover CNIL-specific obligations (cookies guidelines, HDS, DPO registration, post-mortem rights).
+
+## 11. Gap Analysis and Action Plan
+
+| Gap | Reference | Priority | Owner | Deadline |
+|-----|-----------|---------|-------|---------|
+| [Gap description] | [GDPR Article] | 🔴 High | [Role] | [Date] |
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-rgpd` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]