# Privacy, Data Governance & Compliance Twin ## Purpose Webdev Agent OS v20 adds an evidence-oriented operating layer for understanding and governing personal and sensitive data across web systems. It helps teams inventory data, document why it is processed, prove operational controls, manage privacy requests, review vendors, govern retention, and preserve human authority over deletion, disclosure, and breach-notification decisions. This system organizes evidence. It is not legal advice, does not select a lawful basis on its own, and does not certify compliance with any law or contract. ## Evidence chain ```text Product and service purpose → Data inventory → Processing activity and purpose → Consent or other basis evidence → Retention and deletion policy → Vendor and transfer controls → Privacy assessment → Individual-rights request → Approval-gated deletion or disclosure → Breach decision support → Continuous improvement campaign ``` ## Core records ### Data assets A data-asset record identifies the system, data classes, sensitivity, subject groups, source, storage locations, owner, encryption state, processing activities, retention policy, and supporting evidence. Governance records use categories and evidence references rather than raw personal values. ### Processing activities Every processing activity must have: - A specific, understandable purpose - Linked data assets - Subject categories - A documented basis label - Evidence supporting that basis - Recipient categories - An accountable owner - An indication of automated decisioning or profiling The engine rejects activities that have no purpose, no data assets, or no basis evidence. ### Consent evidence Consent records use non-reversible subject references and preserve notice version, status, collection time, expiration, withdrawal, and evidence references. Raw names, email addresses, phone numbers, addresses, identification numbers, passwords, and tokens are rejected from the governance store. ### Retention and disposition Retention policies connect data assets to: - A retention duration - A triggering event - A disposition method - Legal-hold support - Verification evidence - A responsible owner The dashboard calculates retention coverage for personal and sensitive assets. ### Individual-rights requests The request workflow supports access, correction, deletion, portability, restriction, and objection-style records without assuming which rights apply in a particular jurisdiction. Identity verification must be complete before approval or denial is recorded. ### Vendors and transfers Vendor records capture service purpose, data assets, subprocessor status, operating countries, agreement state, security review, privacy review, deletion support, incident-notice commitments, ownership, and evidence. Transfer records capture origin, destination, mechanism label, review status, and supporting evidence. A label is not a legal conclusion; qualified review remains required. ### Privacy assessments Assessments connect high-risk or novel processing to risks, mitigations, residual risk, evidence, an author, and an independent reviewer. Authors cannot approve their own assessment. ### Deletion jobs A deletion job cannot be approved unless it has: - A non-reversible subject reference - An isolated dry run - Dry-run evidence - A legal-hold check - A rollback or recovery reference - A defined scope - Independent reviewer approval The operating system records execution evidence. It does not silently delete data in external systems. ### Disclosure requests Disclosure requests require a minimized scope, evidence, and independent approval. The platform does not transmit or disclose external data automatically. ### Breach decision support Breach assessments connect a security incident to affected data assets, estimated subject count, containment evidence, risk-to-individuals assessment, rationale, reviewer, and notification decision. The platform structures evidence but does not replace qualified legal and incident-response judgment. ## Operational metrics The v20 dashboard calculates: - Personal and sensitive asset counts - Asset ownership coverage - Retention coverage - Valid consent evidence - Open and overdue subject requests - Vendor review completion - Transfer approval status - Pending high-risk assessments - Pending deletion and disclosure approvals - Pending breach decisions - An evidence-weighted privacy health score The health score is an operational prioritization mechanism, not a legal-compliance rating. ## Roles - **Owner:** exports evidence, records approved execution evidence, and governs the operating boundary. - **Developer:** creates and maintains data, processing, vendor, request, assessment, and campaign records. - **Reviewer:** independently approves assessments, deletion jobs, disclosures, and breach decisions. - **Viewer:** receives internal read-only evidence when authorized. - **Client:** denied access to internal data maps, vendor assessments, subject-request evidence, and breach analysis. ## API surface Read operations: ```text GET /api/privacy-governance GET /api/privacy-governance/stats GET /api/privacy-governance/export ``` Governed write operations include programs, data assets, processing activities, consent evidence, retention policies, requests, vendors, transfers, assessments, deletion jobs, disclosure requests, breach assessments, and campaigns. Report generation: ```text POST /api/privacy-governance/report ``` ## Reports The reporting engine produces: ```text privacy-governance-report.html privacy-governance-report.json privacy-governance-report.md ``` ## Production use Before operational use: 1. Replace all fixture records with verified evidence. 2. Define the jurisdictions and contracts that apply. 3. Obtain qualified legal review for policy and legal-basis decisions. 4. Connect only approved external adapters. 5. Keep raw personal data outside the governance store. 6. Require human approval for deletion, disclosure, transfer, and notification decisions. 7. Test retention and deletion behavior in isolated environments. 8. Establish incident, backup, rollback, and audit ownership.