# GDPR — EU General Data Protection Regulation

Mapping for LOMA-PORTAL when EU data subjects are involved. Most controls overlap with PDPA; this doc captures the deltas.

## Lawful basis (Art. 6)

| Basis                         | When                  | Where                       |
| ----------------------------- | --------------------- | --------------------------- |
| Consent (6(1)(a))             | Optional / marketing  | `consent` table             |
| Contract (6(1)(b))            | Employee accounts     | Employment contract         |
| Legal obligation (6(1)(c))    | Tax / audit retention | `audit_logs`                |
| Legitimate interest (6(1)(f)) | Security              | Documented in `SECURITY.md` |

## Rights

| Art. | Right                             | Implementation                                 |
| ---- | --------------------------------- | ---------------------------------------------- |
| 15   | Access (SAR)                      | DSAR — same flow as PDPA §30                   |
| 16   | Rectification                     | Self-service + admin edit                      |
| 17   | Erasure ("right to be forgotten") | `anonymize_user.sql` — preserves FKs for audit |
| 18   | Restriction                       | `User.isActive = false`                        |
| 20   | Portability                       | DSAR export in JSON                            |
| 21   | Objection                         | Withdraw consent in settings                   |
| 22   | Automated decision-making         | LOMA-PORTAL has none today; flag if added      |

## Deltas vs PDPA

| Topic                           | GDPR                                     | PDPA                      | Our stance                                                                                    |
| ------------------------------- | ---------------------------------------- | ------------------------- | --------------------------------------------------------------------------------------------- |
| Breach notification             | 72h to supervisory authority             | 72h to PDPC + subjects    | 72h to both                                                                                   |
| DPO                             | Required if large-scale special category | Required for some sectors | We assign a DPO regardless                                                                    |
| Cross-border                    | Schrems II — adequacy / SCCs / TIA       | §28 mechanisms            | Default storage in EU/Thailand region per project                                             |
| Records of processing (Art. 30) | Required                                 | Not equivalent            | Maintained in `docs/compliance/processing-register.md` (added when first EU subject onboards) |

## Schrems II / cross-border

If hosting in non-adequacy regions, document the safeguards. Default deployment in `eu-west-1` for EU tenants; signed Standard Contractual Clauses with sub-processors.

## DPIA

Required for high-risk processing (Art. 35). Trigger criteria for LOMA-PORTAL:

- Large-scale processing of special category data (health, biometrics).
- Systematic monitoring on a large scale (we don't do this).
- Automated decision-making with legal effects (we don't do this).

If a feature crosses any of those, an ADR + DPIA must precede the build.
