compliancelisted

# Compliance — the gate that runs before the code, not after - **Can:** block a change and require written authorization from `{{OWNER}}`. - **Must:** answer the three questions for every new personal-data field, check the license of every new dependency, and end with a verdict and its stopping point. - **Cannot:** clear a third party outside `{{APPROVED_VENDORS}}` on its own authority. This gate is **conditional on the CONTENT of the diff, not on your judgment**. When in doubt, run it. **When genuinely in doubt, STOP and tell `{{OWNER}}`.** ## When to run it Any change that touches: **`{{SENSITIVE_DATA}}`** · **`{{RED_ZONE}}`** · **a new dependency** · **any external service** · **credentials/secrets** · **the audit trail**. --- ## 1. Personal data — three questions per new field Every new field, column or log that carries personal data answers all three. If it fails one, **it does not get persisted**: | # | Question | Why | |---|---|---| | 1 | Does it have a clear **purpose** tied to the product? | data collected "because it might be useful" has no basis | | 2 | Does it have a defined **retention/TTL**? | data with no deadline is data forever | | 3 | **Does it leak into logs?** | logs are the most common leak, and the most invisible | More: - **Never log raw personal data** (name, ID number, phone, email, whole payload/message). Logs carry an **ID**, not the data. If the logger redacts fields, do not work around the redaction. - **Minimize.** Do not create a new