the_order/docs/governance/frameworks/privacy.md

Privacy & Data Governance Pack

Version: 1.0
Date: November 10, 2025
Status: Draft

---

Overview

This document provides the privacy and data governance framework for the DSB, including Privacy Policy, Data Protection Impact Assessment (DPIA), Data Processing Agreements (DPAs), Records of Processing Activities (ROPA), and Retention & Deletion Schedules.

Privacy Policy

Principles

Data Minimization:

• Collect only necessary data
• Limit data collection scope
• Regular data audits
• Purge unnecessary data

Purpose Limitation:

• Clear purpose statements
• No secondary use without consent
• Regular purpose reviews
• Consent management

Transparency:

• Clear privacy notices
• Accessible policies
• Regular updates
• User notifications

Accountability:

• Data protection officer
• Regular audits
• Compliance monitoring
• Incident reporting

Lawful Bases

Consent:

• Explicit consent for sensitive data
• Withdrawable consent
• Consent management
• Consent records

Legal Obligation:

• KYC/AML requirements
• Sanctions screening
• Regulatory reporting
• Court orders

Legitimate Interests:

• Fraud prevention
• Security measures
• Service improvement
• Analytics (anonymized)

Public Task:

• Governance functions
• Administrative tasks
• Public safety
• Regulatory compliance

Data Protection Impact Assessment (DPIA)

Scope

Assessments:

• Identity verification
• Credential issuance
• KYC/AML screening
• Sanctions screening
• Member registry
• Appeals process

Risk Assessment

Risks:

• Data breaches
• Unauthorized access
• Data loss
• Privacy violations
• Discrimination

Mitigations:

• Encryption
• Access controls
• Audit logging
• Data minimization
• Regular reviews

Residual Risk

Rating:

• Low: Acceptable with standard controls
• Medium: Acceptable with enhanced controls
• High: Requires additional mitigation
• Critical: Cannot proceed without mitigation

Data Processing Agreements (DPAs)

Third-Party Processors

Providers:

• KYC providers (Veriff)
• Sanctions providers (ComplyAdvantage)
• Cloud providers (AWS, Azure)
• Email/SMS providers
• Analytics providers

Requirements

DPA Elements:

• Purpose and scope
• Data types
• Security measures
• Sub-processors
• Data location
• Retention periods
• Deletion procedures
• Audit rights
• Breach notification
• Liability

Records of Processing Activities (ROPA)

Activities

Identity Verification:

• Purpose: Identity verification
• Data: Name, DOB, nationality, documents, selfie
• Lawful basis: Legal obligation, consent
• Retention: 365 days (KYC artifacts), 6 years (metadata)

Credential Issuance:

• Purpose: Credential issuance
• Data: Credential data, proof, status
• Lawful basis: Contract, legal obligation
• Retention: Indefinite (credential status), 6 years (metadata)

KYC/AML Screening:

• Purpose: Compliance screening
• Data: Identity data, screening results
• Lawful basis: Legal obligation
• Retention: 365 days (artifacts), 6 years (results)

Member Registry:

• Purpose: Member management
• Data: Member data, status, history
• Lawful basis: Contract, legitimate interests
• Retention: Indefinite (active members), 6 years (inactive)

Retention & Deletion Schedules

Retention Periods

KYC Artifacts:

• Raw documents: 365 days
• Processed data: 6 years
• Audit logs: 7 years

Application Data:

• Application metadata: 6 years
• Decisions: 6 years
• Appeals: 6 years

Credential Data:

• Credential status: Indefinite
• Credential metadata: 6 years
• Audit logs: 7 years

Member Data:

• Active members: Indefinite
• Inactive members: 6 years after inactivity
• Revoked members: 6 years after revocation

Deletion Procedures

Process:

1. Identify data for deletion
2. Verify retention period expired
3. Backup if required
4. Delete data
5. Verify deletion
6. Update records
7. Audit log

Methods:

• Secure deletion
• Cryptographic erasure
• Physical destruction (if applicable)
• Verification and audit

Individual Rights

Right to Access

Process:

1. Request received
2. Identity verification
3. Data retrieval
4. Response (within 30 days)
5. Data provision

Right to Rectification

Process:

1. Request received
2. Identity verification
3. Data verification
4. Correction
5. Notification
6. Update systems

Right to Erasure

Process:

1. Request received
2. Identity verification
3. Eligibility check
4. Data deletion
5. Verification
6. Notification

Right to Portability

Process:

1. Request received
2. Identity verification
3. Data extraction
4. Format conversion
5. Secure delivery

Data Breach Response

Incident Classification

Personal Data Breach:

• Unauthorized access
• Data loss
• Data alteration
• Unauthorized disclosure

Response Process

1. Immediate containment
2. Impact assessment
3. Notification (if required)
4. Remediation
5. Post-incident review
6. Documentation

Notification

Requirements:

• Supervisory authority: 72 hours
• Affected individuals: Without undue delay
• Content: Nature, impact, measures, advice

---

Revision History

Version	Date	Author	Changes
1.0	2025-11-10	Chancellor	Initial draft

---

Approval

Data Protection Officer: _________________ Date: _________

Chancellor: _________________ Date: _________

Founding Council: _________________ Date: _________