<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Regulatory Compliance Reference

## Regulatory Frameworks (Actionable Subset)

### GDPR Key Operations

- Lawful basis (Art. 6): consent, contract, legal obligation, vital interests,
  public task, legitimate interests (LIA required for last)
- Special category data (Art. 9): health, biometric, racial/ethnic, political,
  religious, union membership, genetic, sexual — requires explicit consent or
  specific derogation
- Data subject rights response timelines: Art. 15-22 requests → 1 month, extendable
  by 2 months with notice
- Breach notification: 72 hours to supervisory authority (Art. 33); to individuals
  if high risk to rights/freedoms (Art. 34)
- DPIA triggers (Art. 35): systematic large-scale profiling, large-scale special
  category processing, systematic public monitoring. WP29 list adds: biometrics,
  invisible processing, matching/combining datasets, IoT, ML scoring with legal effects
- Cross-border transfers: SCCs (Standard Contractual Clauses) most common; adequacy
  decisions (UK, Japan, South Korea, etc.); BCRs for group intra-transfers.
  Post-Schrems II: SCCs must include TIA (Transfer Impact Assessment)

### CCPA/CPRA Consumer Rights

Know, delete, opt-out of sale/sharing, correct, limit use of sensitive PI.
CPRA adds: sensitive PI category (SSN, precise geolocation, racial origin,
health, finances, sexual orientation) — right to limit use. CPPA enforcement
from 2023.

### HIPAA/HITECH

PHI = health info linked to 18 identifiers. Minimum necessary standard for all
disclosures. BAA required for all business associates with PHI access. Breach
notification: 60 days to HHS, individuals; media if >500 affected in state.
HITECH multiplies civil penalties: $100-$50k per violation, $1.9M annual cap
per category.

---

## DPIA Execution (GDPR Art. 35)

1. Trigger check: does processing meet high-risk criteria? If no, document and stop.
2. Describe processing: purpose, legal basis, data types, retention, recipients
3. Necessity/proportionality assessment: is processing minimum necessary for purpose?
4. Risk identification: LINDDUN analysis on data flows; rate likelihood + severity
5. Risk mitigation: apply controls (encryption, pseudonymization, access restrictions,
   data minimization); assess residual risk
6. DPO consultation (required); document outcome
7. If high residual risk remains → prior consultation with supervisory authority (Art. 36)
8. Review trigger: any significant change to processing restarts the cycle

### DPIA Quick Checks

- DPIA trigger check: high risk = large-scale processing, systematic monitoring, sensitive data categories
- Data subject rights response timelines: Art. 15-22 requests → 1 month, extendable by 2 months with notice
- Breach notification: 72 hours to supervisory authority (Art. 33)

---

## Privacy by Design (PbD)

7 foundational principles (Cavoukian):
1. Proactive, not reactive — prevent before detecting
2. Privacy as default — maximum privacy without user action
3. Privacy embedded into design — not bolted on
4. Full functionality — positive-sum, not zero-sum
5. End-to-end security — data lifecycle protection
6. Visibility and transparency — verify independently
7. Respect for user privacy — user-centric design

**Operationalizing PbD:**
- Data minimization at collection: collect only fields needed for stated purpose
- Purpose limitation: bind collected data to declared purpose in schema design
- Storage limitation: automated deletion jobs keyed to retention periods
- Access controls: least-privilege by default; JIT access for admin functions
- Default settings: privacy-protective by default, require user action to reduce privacy
- Data flow mapping: ROPA (Art. 30 GDPR) before any new data processing

---

## Anonymization and De-identification

**HIPAA safe harbor:** Remove 18 specified identifiers (name, zip, dates except year,
phone, email, SSN, medical record numbers, IP, biometrics, photos, etc.) AND
no actual knowledge residual risk. Alternative: expert determination (statistical
analysis showing re-identification risk < 0.09).

**Anonymization standard (GDPR Recital 26):** Irreversibly prevent identification
— both directly and by combination with other data "reasonably likely to be used."
Pseudonymization is NOT anonymization (still personal data under GDPR).

**K-anonymity:** Every record indistinguishable from ≥k-1 others on quasi-identifiers.
Fails against: background knowledge attacks, skewed distributions.

**L-diversity:** Each equivalence class has ≥l distinct sensitive values.
Protects against homogeneity attack on k-anonymous data.

**T-closeness:** Distribution of sensitive values in equivalence class ≤t from
overall distribution. Strongest formal guarantee; hardest to achieve while retaining utility.

**Differential privacy:** Output of query ≤ e^ε different whether any individual
included or not. ε = privacy budget (lower = more private). Used for aggregate
statistics release, ML training data, telemetry.

**Anti-pattern:** Releasing a "de-identified" dataset that includes ZIP + DOB +
gender — 87% of US population uniquely identifiable from this combination.
Remove or generalize quasi-identifiers before release.

---
v1.1 | Validated: 2026-03-13
