coulomb/risk-nexus
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Review the overdue regulatory records

Browse source 
RISK-REG-0001: eight-year voucher period (BEG IV) confirmed against
secondary sources and §147 AO. RISK-POL-0009/0002: positions unchanged; new
restore evidence noted as partial. RISK-POL-0012: receiving duty still
unowned; issuing phase-in dates added, flagged for confirmation.
RISK-POL-0011: stays dormant.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 6903@bnt-lap001
Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89
This commit is contained in:
tegwick 2026-09-22 08:26:43 +02:00
parent aa0a85b893
commit 5a7e4ac2d4
5 changed files with 85 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/regulatory/audit-retention-basis.md
View file

@ -6,13 +6,13 @@ status: determined-internally
owner: risk-nexus
determined: "2026-08-20"
finding: RISK-F-0008
sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147"
sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147; BEG IV (BGBl. 2024 I Nr. 323) secondary summaries"
external_review: none
last_checked: "2026-09-02T08:11:18Z"
next_check: "2026-09-02T09:11:18Z"
cadence: 1h
clean_streak: 1
checked_by: "grok/risk-nexus"
last_checked: "2026-09-22T06:25:39Z"
next_check: "2026-09-22T14:25:39Z"
cadence: 8h
clean_streak: 2
checked_by: "worsch"
---
# RISK-REG-0001 — the retention basis, written down
@ -138,7 +138,7 @@ can argue with is stronger than an honest blank.
| --- | --- | --- |
| Operator and agent security audit records | **12 months** | Art 6(1)(f) with Art 32. Twelve months covers an annual review cycle and the ordinary lag between an incident happening and being discovered. Longer needs a specific reason, per record class, not a habit. |
| Counterparty transaction evidence | **3 years, running to the end of the third calendar year** | Art 17(3)(e), defence of legal claims, tracking the general German limitation period (§195, §199 BGB — three years from the end of the year in which the claim arose). Evidence outliving the claim it could defend has no ground. |
| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act with effect from 2025. **Worth confirming before relied on** — it is recent and this repo has not verified it against the current text. |
| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act (BEG IV, promulgated 2024-10-29) with effect from 2025-01-01, including vouchers whose period had not expired by then. Confirmed 2026-09-22 against secondary sources (Haufe, datenschutz-notizen) and the `gesetze-im-internet.de` text of §147 AO. This is not a qualified review. |
| Books, inventories, annual accounts | **10 years** | §257 HGB, unchanged by that reform. |
| Commercial and business letters | **6 years** | §257 HGB. |
| Personal data in audit records falling in none of the above | **delete** | No ground identified means no retention. The operator's minimisation ruling of 2026-08-20 should mean this category is close to empty by construction. |
@ -169,8 +169,6 @@ table as a compliance claim.
- **A keyed commitment working** (`RISK-F-0008`). Then erasure becomes
available and the retention argument narrows to the retained-by-obligation
rows only, which are the strong ones.
- **Confirmation of the eight-year voucher period.** Flagged above; the rest of
the table does not depend on it.
- **Any of the three triggers** for buying an external determination, which
remain unruled.
@ -180,3 +178,4 @@ unresolved.
- **2026-09-01** — not clean: the dated review found that the 2026-08-20 target-period amendment had never advanced this record's check state. The targets now stand explicitly; achievement under the shared backup horizon and keyed-commitment feasibility remain open. Cadence 1h → instant; checked again immediately.
- **2026-09-02** — clean check: grounds and target periods unchanged; still waiting on the platform-pg co-residency horizon. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z.
- **2026-09-22** — clean check: Grounds and target periods unchanged; eight-year voucher period (BEG IV, from 2025-01-01) confirmed against secondary sources and AO §147; audit-core co-residency horizon and keyed commitment unchanged since 2026-09-02. Cadence 1h → 8h (2 clean in a row); next check 2026-09-22 14:25Z.