Privacy, GDPR y EU AI Act sections del checklist

Descripción

Llenamos las sections 2-4 del checklist: Privacy, Transparency, y Compliance. Items derivados directamente de M3, M4, M5 work.

Al terminar tendrás 14-17 items adicionales bien specifíados para tu checklist.

---

Section 2: Privacy and Data Protection (5-6 items)

## Item 2.1: Data inventory complete

**Question**: Is there documented inventory of all personal data fields
processed by the system (training + inference)?

**Why**: Cannot apply data minimization without knowing what you have.

**Evidence**: Data inventory document with field names, purposes,
sources, retention periods.

**Critical**: Yes

---

## Item 2.2: Data minimization applied

**Question**: For each personal data field, is necessity justified
documentation OR has the field been removed?

**Why**: GDPR Art. 5(1)(c) data minimization principle.

**Evidence**: Per-field justification in data inventory; removed fields
documented as such.

**Critical**: Yes

---

## Item 2.3: Anonymization/pseudonymization applied where possible

**Question**: For data fields not requiring direct identification, has
anonymization or pseudonymization been applied?

**Why**: Reduces risk of breach impact; supports GDPR.

**Evidence**: Anonymization procedure documented; verified in code review.

**Critical**: Medium

---

## Item 2.4: Multi-tenant data isolation verified

**Question**: For multi-tenant systems, is tenant data isolation verified
through testing (penetration test or comprehensive test cases)?

**Why**: Cross-tenant leakage is catastrophic legally and
reputationally.

**Evidence**: Test results showing tenant isolation; penetration test
report.

**Critical**: Yes (for multi-tenant systems)

---

## Item 2.5: Retention policy implemented

**Question**: Are retention periods defined per data category and
automatically enforced via TTL or scheduled deletion?

**Why**: GDPR requires storage limitation. Manual deletion = unreliable.

**Evidence**: Retention policy document; automated job evidence.

**Critical**: Yes

---

## Item 2.6: Encryption at rest and in transit

**Question**: Is all personal data encrypted at rest (AES-256+) and in
transit (TLS 1.2+)?

**Why**: GDPR Art. 32 security; best practice; reduces breach impact.

**Evidence**: Encryption config; SSL/TLS validator report.

**Critical**: Yes

---

Section 3: Transparency and Explainability (4-5 items)

## Item 3.1: AI disclosure to users

**Question**: Are users explicitly informed they are interacting with AI?

**Why**: EU AI Act limited risk requirement + general transparency.

**Evidence**: User onboarding screenshots; UI showing AI indicator.

**Critical**: Yes

---

## Item 3.2: Decision explanations provided

**Question**: For automated decisions affecting users, is meaningful
explanation provided?

**Why**: GDPR Art. 22; user right to understand.

**Evidence**: Explanation template; sample notifications.

**Critical**: Yes for systems with automated decisions

---

## Item 3.3: Source citations or sources shown

**Question**: For information-based outputs, are sources cited or
shown to user?

**Why**: Enables verification; reduces overreliance; supports
accountability.

**Evidence**: UI showing citations; sample responses.

**Critical**: Yes for information systems

---

## Item 3.4: System limitations disclosed

**Question**: Are known system limitations documented and disclosed to
users where relevant?

**Why**: Sets correct expectations; reduces misuse.

**Evidence**: Limitations documentation; UI disclosures.

**Critical**: Medium

---

## Item 3.5: Confidence indicators (where applicable)

**Question**: For probabilistic outputs, are confidence indicators
shown to users?

**Why**: Users make better decisions with confidence info.

**Evidence**: UI showing confidence; threshold documentation.

**Critical**: Medium

---

Section 4: Compliance — EU AI Act + GDPR (6-7 items)

## Item 4.1: EU AI Act risk classification

**Question**: Has the system been classified by EU AI Act risk
category (unacceptable, high, limited, minimal)?

**Why**: Risk category determines compliance obligations.

**Evidence**: Risk Classification document (M4 deliverable).

**Critical**: Yes

---

## Item 4.2: High-risk obligations met (if high-risk)

**Question**: If classified as high-risk, are all Article 9-15 obligations
implemented (risk management, data quality, documentation, logging,
transparency, human oversight, accuracy, robustness)?

**Why**: High-risk AI cannot be deployed in EU without these.

**Evidence**: Compliance matrix per obligation.

**Critical**: Yes (if high-risk)

---

## Item 4.3: GDPR Art. 22 — automated decisions

**Question**: For automated decisions, is Art. 22 compliance achieved
(meaningful information about logic, human review available, right to
contest)?

**Why**: Legal mandate; multi-million euro fines for violation.

**Evidence**: User-facing notifications; human review workflow.

**Critical**: Yes (if Art. 22 applies)

---

## Item 4.4: Lawful basis documented per processing

**Question**: Is each processing activity documented with a clear
lawful basis (consent, contract, legitimate interest, etc.)?

**Why**: GDPR Art. 6 requirement.

**Evidence**: RoPA with lawful basis per activity.

**Critical**: Yes

---

## Item 4.5: Data subject rights implemented

**Question**: Are processes implemented for all GDPR data subject
rights (access, rectification, erasure, portability, object, restrict)?

**Why**: Legal mandate; SLA 1 month for responses.

**Evidence**: Process documentation; sample request handled.

**Critical**: Yes

---

## Item 4.6: International transfers safeguarded

**Question**: For data transfers outside EU, are appropriate safeguards
in place (SCCs, BCRs, adequacy decision)?

**Why**: GDPR Chapter V.

**Evidence**: SCCs with processors; legal review.

**Critical**: Yes (if transfers occur)

---

## Item 4.7: Breach notification procedure ready

**Question**: Is breach notification procedure documented enabling
72-hour notification to supervisor authority?

**Why**: GDPR Art. 33 obligation.

**Evidence**: Incident response runbook; team training records.

**Critical**: Yes

---

Trampas comunes para estas sections

Trampa 1 — "We comply with GDPR". Demasiado vago. Specify EACH article + how.

Trampa 2 — Cross-references entre sections sin claridad. Item 4.3 references Art. 22 from M5. Document it: "see Item 4.3 and its evidence."

Trampa 3 — Item 4.6 ignorado. "Pinecone es US" → entonces tenés transfer. Need SCCs documented.

Trampa 4 — Item 4.7 sin team training. Documented procedure pero team no sabe. Breach happens, response slow.

---

Ejercicio

Llená las 3 sections para tu sistema:

1. Privacy section: status de cada item con evidence
2. Transparency section: status de cada item
3. Compliance section: status de cada item
4. Identifica "No" items y plan remediation

---

Resumen

Aprendiste:

• ✅ Section 2 (Privacy): 6 items
• ✅ Section 3 (Transparency): 5 items
• ✅ Section 4 (Compliance): 7 items
• ✅ Each item linked a M3-M5 work
• ✅ Critical flags marcando blockers

Checkpoint: si tenés 18+ items con full format, juntando con section 1 (6 items) ya tenés ~24 items.

---

Siguiente cápsula

05 — Review processes. Tenés items. Ahora diseñá CUÁNDO se aplican, QUIÉN participa, y QUÉ pasa cuando hay "No".

---

Recursos

1. GDPR Compliance Checklist M5.
2. EU AI Act Risk Classification M4.
3. Privacy Assessment M3.