74 lines
4 KiB
Markdown
74 lines
4 KiB
Markdown
|
# Legal policy set
|
|||
|
|
|
|||
|
|
A catalogue of legal positions the estate will need, **written before they are
|
|||
|
|
needed and dormant until a context activates one**.
|
|||
|
|
|
|||
|
|
Operator ruling, 2026-08-20: the estate will not buy an external determination
|
|||
|
|
in build mode (`RISK-F-0008`). What it will do instead is keep this set, so
|
|||
|
|
that when a work context arrives which needs a specific legal position in
|
|||
|
|
place, the position is retrieved rather than researched from scratch.
|
|||
|
|
|
|||
|
|
That is a direct answer to the failure `INTENT.md` names — regulation
|
|||
|
|
"consulted and discarded", the same question asked twice and the answer
|
|||
|
|
silently expiring.
|
|||
|
|
|
|||
|
|
## How a policy works
|
|||
|
|
|
|||
|
|
Each policy is dormant, active, or superseded, and carries an **activation
|
|||
|
|
condition**: the fact about the world that makes it apply. Nothing here is a
|
|||
|
|
compliance claim. A dormant policy asserts nothing about today; it states what
|
|||
|
|
would be required *if* its condition became true, so that the day it does, the
|
|||
|
|
work is retrieval rather than discovery.
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
id: RISK-POL-0002
|
|||
|
|
regime: GDPR
|
|||
|
|
status: dormant
|
|||
|
|
activates_when: "the estate holds personal data of an identifiable natural person"
|
|||
|
|
requires_of_systems: [...]
|
|||
|
|
evidence: what would have to exist to show it is met
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**A policy is not a plan and does not schedule work.** It is what the owning
|
|||
|
|
repo consults when its context changes. Deciding what to build in response is
|
|||
|
|
the owning repo's, as `INTENT.md` requires.
|
|||
|
|
|
|||
|
|
## Retrieval by context
|
|||
|
|
|
|||
|
|
The point of the set is that a context pulls a slice. Some worked examples:
|
|||
|
|
|
|||
|
|
| A context like… | Pulls |
|
|||
|
|
| --- | --- |
|
|||
|
|
| First real user account, of any kind | `0001`, `0002`, `0003`, `0004`, `0005`, `0008` |
|
|||
|
|
| Consumer-facing product in Germany | the above plus `0011`, and `0010` if an agent talks to them |
|
|||
|
|
| A vendor processing our data | `0006`, and `0007` if outside the EU |
|
|||
|
|
| Selling to a business customer | `0009`, `0012`, and `0006` if we process for them |
|
|||
|
|
| Public-sector procurement | `0013` |
|
|||
|
|
|
|||
|
|
## The set
|
|||
|
|
|
|||
|
|
| ID | Regime | Policy | Status | Activates when |
|
|||
|
|
| --- | --- | --- | --- | --- |
|
|||
|
|
| `0001` | GDPR Art 6 | Lawful basis for processing | dormant | any processing of personal data begins |
|
|||
|
|
| `0002` | GDPR Arts 5(1)(e), 17 | Retention and erasure | **part-active** | any personal data is held — the commercial half is already live |
|
|||
|
|
| `0003` | GDPR Arts 15–22 | Data subject rights handling | dormant | a natural person can identify themselves to us |
|
|||
|
|
| `0004` | GDPR Art 32 | Security of processing | dormant | personal data is processed |
|
|||
|
|
| `0005` | GDPR Arts 33–34 | Breach notification, 72 hours | dormant | personal data is held; fires on the first breach, not before |
|
|||
|
|
| `0006` | GDPR Art 28 | Processors and sub-processors | dormant | a vendor processes personal data on our behalf |
|
|||
|
|
| `0007` | GDPR Arts 44+ | International transfers | dormant | personal data leaves the EEA, including to a vendor's support desk |
|
|||
|
|
| `0008` | GDPR Art 30 | Records of processing | dormant | processing begins and the small-scale exemption does not hold |
|
|||
|
|
| `0009` | HGB §257, AO §147 | Commercial and tax retention | **active** | already — the estate invoices and books |
|
|||
|
|
| `0010` | EU AI Act | AI transparency and deployer duties | dormant | an AI system interacts with a person, or is placed on the market |
|
|||
|
|
| `0011` | BFSG / EAA | Accessibility of digital services | dormant | a consumer-facing digital service is offered in Germany |
|
|||
|
|
| `0012` | UStG / ViDA | E-invoicing | **active** | already — a German business must be able to receive structured e-invoices |
|
|||
|
|
| `0013` | GWB / VgV / UVgO | Public procurement participation | dormant | the estate bids for public contracts |
|
|||
|
|
|
|||
|
|
Written in full so far: `0002`, `0009`, `0011`, `0012` — the two that are
|
|||
|
|
already active, and the two most likely to activate next. The rest carry their
|
|||
|
|
activation condition here and are written when a context approaches, which is
|
|||
|
|
the point of the catalogue: **the trigger is recorded now, the text is written
|
|||
|
|
when it is needed.**
|
|||
|
|
|
|||
|
|
Every entry is `risk-nexus`'s record of what a source says. None of it is legal
|
|||
|
|
advice, and this repo cannot make it into any.
|