Skip to content

M7 — GDPR/CCPA Evidence (Data Inventory + DSAR Workflow) — Test Runbook

Asset: M7 — the data inventory / RoPA register (compliance/data-inventory/) + the DSAR workflow + the per-request evidence record (compliance/dsar/). Owner: CO · Milestone: M4. Documentation/evidence asset — offline gate + a worked dry-run; no cloud phase.

Part A — Offline gate (~2 min, $0)

python3 compliance/data-inventory/validate.py

Acceptance: - [ ] Reports the template (and any filled data-inventory.yaml) valid. - [ ] Fail-closed check — break a copy and confirm exit 1: 

sed 's/lawful_basis: contract/lawful_basis: vibes/' \
  compliance/data-inventory/data-inventory.template.yaml > /tmp/bad.yaml
python3 compliance/data-inventory/validate.py /tmp/bad.yaml   # expect exit 1
- [ ] The gate enforces: required fields per activity, the GDPR Art. 6 lawful_basis enum, the data_categories enum, retention with both period and basis, dpa_in_place per processor, non-empty dsar_lookup, unique ids.

Part B — Worked DSAR dry-run (~10 min, $0)

Walk one synthetic request end to end without touching real data:

  1. Copy dsar-record.template.md to /tmp/2026-06-10-test-ref.md; set type = deletion, regime = GDPR.
  2. The due date computes from receipt (+30d GDPR), not verification.
  3. Step 2 of the workflow is mechanical: each template activity's dsar_lookup tells you exactly where/how to search — no archaeology.
  4. The J1 telemetry activity resolves to a documented security-retention exemption, not a silent skip.
  5. The backups statement claims aging-out per L1 retention — never a selective backup purge.
  6. The record lands in compliance/dsar/ with a pseudonymous filename.

Part C — Adoption (per client, ~30 min, $0)

  • Copy the template to the client's data-inventory.yaml; fill every activity with a real owner + dsar_lookup; gate passes.
  • Cross-check residency values against the M6 allowed-locations policy and security_controls against the deployed M1/M2/M3/N5/J6 assets.
  • Where M4 (Purview) is deployed: reconcile a classification scan against the register; any data Purview finds that the register misses is fixed in the same PR.
  • Quarterly review date set; annual synthetic-DSAR tabletop scheduled.

Notes

  • M7 is the evidence/process layer: M4 discovers, M5 prevents egress, M6 pins residency, M1/M2/M3 encrypt — M7 proves you know your data and can answer for it on the statutory clocks.