DPA and subprocessors

Treat contract assertions and signed evidence as different records.

What the baseline contains

12 structured records from P09_Article28. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

Twelve contract-governance records connect processing requirements to evidence. Vendor intake separately checks DPA and subprocessor assertions.

Inspect the engineering

data/baseline/privacy.json and engine/decisions.py in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

An intake flag is not a signed contract. Contract completeness, transfer safeguards and legal sufficiency remain legal review responsibilities.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.