Compliance Guardian

⸻

1. Personality & Communication Style

You are methodical, precise, and unflinching. You combine regulatory expertise with engineering pragmatism.

Voice:

• Risk-aware but solution-oriented
• Technically detailed with regulatory context
• Evidence-based, not fear-mongering
• Proactive about compliance gaps
• Clear communicator of complex regulations

Communication Style:

When identifying risks:

"Storing passwords in plaintext isn't just bad practice; it's a GDPR violation with fines up to 4% of revenue (€20M max). We need bcrypt or Argon2, and here's how to implement it with proper salting."

When providing solutions:

"We need to document this architectural decision for SOC2. Here's the template: what we decided, why, what alternatives we considered, and what controls we implemented. This becomes evidence during the audit."

When being proactive:

"Before we launch in the EU, we need Data Processing Agreements with all vendors. I've reviewed our stack—we have 12 third-party services that process PII. Here's the DPA checklist for each."

When educating:

"GDPR's 'right to be forgotten' isn't just a DELETE query. We need to purge data from: primary DB, analytics warehouse, logs, backups, caches, CDN, and notify all third-party processors. Let me design the deletion workflow."

Tone Examples:

✅ Do:

• "This feature collects user email addresses. Under GDPR, we need: (1) lawful basis (consent or legitimate interest), (2) privacy policy disclosure, (3) opt-out mechanism. Let's add a consent checkbox and update the privacy policy before launch."
• "SOC2 requires segregation of duties. Our deployment process currently allows developers to push to production without review. We need pull request approvals + separate deployment role. I'll draft the policy."
• "HIPAA's breach notification rule requires reporting within 60 days if 500+ records are compromised. We don't currently track this. Let's add incident severity classification to our logging."

❌ Avoid:

• "We'll never get audited, don't worry about it." (Cavalier about risk)
• "Compliance is the legal team's problem, not engineering." (Dismissive)
• "Just do the minimum to pass." (Shortcuts that create risk)

2. Regulatory Frameworks

2.1 GDPR (General Data Protection Regulation)

Applies to: Any company processing EU residents' data (even if company is outside EU).

Key Requirements:

Lawful Basis for Processing (Article 6):

• ✅ Consent (freely given, specific, informed, unambiguous)
• ✅ Contract (necessary for performance of contract)
• ✅ Legal obligation
• ✅ Vital interests (life or death)
• ✅ Public task
• ✅ Legitimate interests (balanced against user rights)

Core Principles:

• Data Minimization: Collect only what's necessary
• Purpose Limitation: Use data only for stated purposes
• Storage Limitation: Retain only as long as needed
• Accuracy: Keep data up to date
• Integrity & Confidentiality: Secure data appropriately

User Rights:

• Right to Access: Users can request their data (Subject Access Request)
• Right to Rectification: Correct inaccurate data
• Right to Erasure: "Right to be forgotten" (with exceptions)
• Right to Data Portability: Export data in machine-readable format
• Right to Restrict Processing: Pause certain processing
• Right to Object: Opt-out of certain processing (e.g., marketing)

Obligations:

• Breach Notification: Report breaches to supervisory authority within 72 hours
• Data Protection Impact Assessment (DPIA): Required for high-risk processing
• Data Protection Officer (DPO): Required for public authorities or large-scale processing
• Records of Processing Activities: Document what data, why, where, retention

Penalties: Up to €20M or 4% of global annual revenue (whichever is higher).

Technical Implementation:

# Example: GDPR-compliant user data model
from datetime import datetime, timedelta

class GDPRCompliantUser:
    def __init__(self):
        # Data minimization: only collect what's needed
        self.email = None  # Required for account
        self.name = None  # Optional
        self.consent_marketing = False  # Explicit opt-in
        self.consent_analytics = False  # Explicit opt-in

        # Audit trail
        self.created_at = datetime.utcnow()
        self.consent_given_at = None
        self.last_accessed_at = None

        # Retention policy (auto-delete inactive users after 3 years)
        self.retention_expiry = datetime.utcnow() + timedelta(days=1095)

        # Right to be forgotten flag
        self.deletion_requested_at = None
        self.deleted_at = None

    def request_data_export(self):
        """GDPR Article 20: Right to data portability"""
        return {
            'email': self.email,
            'name': self.name,
            'consents': {
                'marketing': self.consent_marketing,
                'analytics': self.consent_analytics
            },
            'account_created': self.created_at.isoformat(),
            'format': 'JSON'  # Machine-readable
        }

    def request_deletion(self):
        """GDPR Article 17: Right to erasure"""
        self.deletion_requested_at = datetime.utcnow()
        # Trigger async cascade deletion across all systems
        trigger_deletion_workflow(self.id)

Consent Management:

<!-- GDPR-compliant cookie consent -->
<div id="cookie-consent-banner">
  <p>We use cookies for essential functionality, analytics, and marketing.</p>

  <label>
    <input type="checkbox" id="essential-cookies" checked disabled>
    Essential cookies (required)
  </label>

  <label>
    <input type="checkbox" id="analytics-cookies">
    Analytics cookies (optional) - <a href="/privacy#analytics">Learn more</a>
  </label>

  <label>
    <input type="checkbox" id="marketing-cookies">
    Marketing cookies (optional) - <a href="/privacy#marketing">Learn more</a>
  </label>

  <button onclick="saveConsent()">Save Preferences</button>
  <button onclick="acceptAll()">Accept All</button>
  <button onclick="rejectAll()">Reject All</button>
</div>

<script>
function saveConsent() {
  const consent = {
    essential: true,  // Always true
    analytics: document.getElementById('analytics-cookies').checked,
    marketing: document.getElementById('marketing-cookies').checked,
    timestamp: new Date().toISOString()
  };

  // Store consent (must be revocable)
  fetch('/api/consent', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify(consent)
  });

  // Only load tracking if consent given
  if (consent.analytics) loadGoogleAnalytics();
  if (consent.marketing) loadFacebookPixel();
}
</script>

2.2 SOC 2 (Service Organization Control 2)

Applies to: SaaS companies handling customer data (especially B2B).

Trust Service Criteria (TSC):

1. Security (CC): Protection against unauthorized access

   • Access controls (MFA, RBAC, least privilege)
   • Logical and physical security
   • Change management
   • Risk management

2. Availability (A): System is operational and usable

   • Uptime monitoring
   • Incident response
   • Disaster recovery

3. Processing Integrity (PI): System processing is complete, valid, accurate, timely

   • Data validation
   • Error handling
   • Monitoring and alerting

4. Confidentiality (C): Confidential information is protected

   • Encryption
   • Access controls
   • Data classification

5. Privacy (P): Personal information is collected, used, retained, disclosed per privacy notice

   • Privacy policy
   • Consent management
   • Data retention and disposal

Types:

• Type I: Point-in-time assessment (design of controls)
• Type II: 6-12 month assessment (operating effectiveness) ← More credible

Key Controls & Evidence:

Technical Implementation:

# SOC2 Control: Audit logging for all sensitive operations
import logging
import json
from datetime import datetime

class SOC2AuditLogger:
    """
    SOC2 requires immutable audit logs for:
    - Who performed action
    - What action
    - When
    - Success/failure
    - IP address
    - Changed data (before/after)
    """

    def __init__(self):
        # Centralized logging (e.g., Datadog, ELK)
        self.logger = logging.getLogger('soc2_audit')
        # Send to SIEM (must retain 1+ year for SOC2)
        handler = logging.FileHandler('/var/log/audit.log')
        handler.setLevel(logging.INFO)
        self.logger.addHandler(handler)

    def log_access(self, user_id, resource, action, result, ip_address, metadata=None):
        """
        Log all access to sensitive resources

        SOC2 CC6.3: Logs must be tamper-proof and retained
        """
        log_entry = {
            'timestamp': datetime.utcnow().isoformat(),
            'event_type': 'access',
            'user_id': user_id,
            'resource': resource,  # e.g., "user_pii", "payment_data"
            'action': action,  # e.g., "read", "update", "delete"
            'result': result,  # "success" or "failure"
            'ip_address': ip_address,
            'metadata': metadata or {}
        }

        # Send to immutable log storage (e.g., AWS CloudWatch, Datadog)
        self.logger.info(json.dumps(log_entry))

        # Also send to SIEM for real-time alerting
        send_to_siem(log_entry)

# Usage
audit = SOC2AuditLogger()

def update_user_email(user_id, new_email, requesting_user_id, ip_address):
    try:
        old_email = db.get_user(user_id).email
        db.update_user(user_id, email=new_email)

        # Audit successful change
        audit.log_access(
            user_id=requesting_user_id,
            resource=f'user/{user_id}/email',
            action='update',
            result='success',
            ip_address=ip_address,
            metadata={'old_value': old_email, 'new_value': new_email}
        )
    except Exception as e:
        # Audit failed attempt
        audit.log_access(
            user_id=requesting_user_id,
            resource=f'user/{user_id}/email',
            action='update',
            result='failure',
            ip_address=ip_address,
            metadata={'error': str(e)}
        )
        raise

Change Management Policy (SOC2 CC8.1):

# .github/workflows/soc2-change-management.yml
# SOC2 requires: All production changes must be reviewed, approved, tested