# GDPR Compliance Documentation

> Auto-generated by Prism from the project specification.
> Organization: **{{ organization_name }}**
> Generated: {{ generated_at }}

## 1. Data Controller Information

| Field | Value |
|-------|-------|
| Organization | {{ organization_name }} |
| DPO Contact | {{ dpo_email }} |
| Privacy Policy | {{ privacy_policy_url }} |
| Data Processing Region | {{ data_processing_region }} |

## 2. Personal Data Inventory

The following models store personal data and are subject to GDPR:

{% for model in personal_data_models %}
### {{ model.name }}

- **Purpose**: {{ model.purpose or "Not specified" }}
- **Legal Basis**: {{ model.legal_basis | replace('_', ' ') | title }}
- **Contains PII Fields**: {{ model.pii_fields | join(', ') or "None tagged" }}
{% if model.retention %}
- **Retention Period**: {{ model.retention_days }} days
- **Auto-Delete**: {{ "Yes" if model.auto_delete else "No" }}
{% else %}
- **Retention Period**: Indefinite
{% endif %}

| Field | Classification | PII | Encrypted | Redacted in Logs |
|-------|---------------|-----|-----------|-----------------|
{% for field in model.fields_with_privacy %}
| {{ field.name }} | {{ field.classification }} | {{ "Yes" if field.is_pii else "No" }} | {{ "Yes" if field.encrypt_at_rest else "No" }} | {{ "Yes" if field.redact_in_logs else "No" }} |
{% endfor %}
{% if not model.fields_with_privacy %}
| *(No fields have privacy configuration)* | | | | |
{% endif %}

{% endfor %}

## 3. Data Subject Rights Implementation

| Right | Article | Status | Endpoint |
|-------|---------|--------|----------|
| Right to Access | Art. 15 | {{ "Implemented" if has_export else "Not generated" }} | `POST /api/v1/privacy/export/{subject_id}` |
| Right to Rectification | Art. 16 | Tracked via audit log | Standard CRUD update endpoints |
| Right to Erasure | Art. 17 | {{ "Implemented" if has_deletion else "Not generated" }} | `POST /api/v1/privacy/erase/{subject_id}` |
| Right to Restrict Processing | Art. 18 | {{ "Implemented" if has_restriction else "Not generated" }} | — |
| Right to Data Portability | Art. 20 | {{ "Implemented" if has_export else "Not generated" }} | `POST /api/v1/privacy/export/{subject_id}?format=csv` |

### Supported Export Formats

{% for fmt in export_formats %}
- {{ fmt | upper }}
{% endfor %}

## 4. Audit Trail

{% if has_audit_log %}
All operations on personal data are recorded in the `privacy_audit_log` table:

- **Tracked operations**: create, read, update, delete, export, erase
- **Recorded fields**: timestamp, user_id, operation, model_name, record_id, ip_address, details
- **Query endpoint**: `GET /api/v1/privacy/audit-log`
{% else %}
Audit logging is not enabled for this project.
{% endif %}

## 5. Data Retention Schedule

{% if retention_models %}
| Model | Retention Period | Auto-Delete | Soft-Delete First | Archive Before Delete |
|-------|-----------------|-------------|-------------------|--------------------|
{% for model in retention_models %}
| {{ model.name }} | {{ model.retention_days }} days | {{ "Yes" if model.auto_delete else "No" }} | {{ "Yes" if model.soft_delete_first else "No" }} | {{ "Yes" if model.archive_before_delete else "No" }} |
{% endfor %}

**Retention enforcement endpoint**: `POST /api/v1/privacy/retention/enforce`
**Retention report endpoint**: `GET /api/v1/privacy/retention/report`
{% else %}
No retention policies are configured. Data is retained indefinitely.
{% endif %}

## 6. Third-Party Subprocessors

{% if subprocessors %}
| Subprocessor | Purpose |
|-------------|---------|
{% for sp in subprocessors %}
| {{ sp }} | — |
{% endfor %}
{% else %}
No third-party subprocessors are declared in the specification.
{% endif %}

## 7. Technical Measures

- [x] Audit logging for personal data access
- [x] Structured data export (JSON, CSV)
- [x] Data subject erasure/anonymization endpoints
{% if has_retention %}
- [x] Automated data retention enforcement
{% endif %}
- [x] Field-level data classification
- [ ] Consent management (implement in application layer)
- [ ] Data breach notification workflow (implement in application layer)

---

*This document is auto-generated from the Prism specification. Review and supplement
with organizational policies before using for regulatory compliance.*
