# `docs/compliance/`

Privacy + security compliance for LOMA-PORTAL.

| File                          | Topic                                             |
| ----------------------------- | ------------------------------------------------- |
| `pdpa.md`                     | Thai PDPA mapping — articles to controls          |
| `gdpr.md`                     | GDPR mapping — focus on deltas from PDPA          |
| `data-classification.md`      | Four tiers + per-Prisma-model assignment          |
| `data-retention.md`           | Per-entity retention windows + purge jobs         |
| `dsar-runbook.md`             | Data Subject Access Request handling              |
| `right-to-erasure-runbook.md` | Anonymize-in-place workflow                       |
| `consent-management.md`       | Consent capture + storage + honoring + withdrawal |
| `breach-response-playbook.md` | Incident → notify regulator/subjects → remediate  |

## When to read these

- Adding a new field that holds personal data → `data-classification.md`.
- A user emails asking for their data → `dsar-runbook.md`.
- A user asks to be deleted → `right-to-erasure-runbook.md`.
- Adding a marketing/optional feature → `consent-management.md`.
- Possible breach → `breach-response-playbook.md` (and page on-call NOW).

## Cross-references

- [`SECURITY.md`](../../SECURITY.md)
- [`prisma/schema.prisma`](../../prisma/schema.prisma) (`AuditLog`, `User`, `RefreshToken`)
- `database/scripts/anonymize/anonymize_user.sql`
- `.claude/skills/pdpa-data-export/SKILL.md`, `pdpa-data-deletion/SKILL.md`
