pook/compliancebot

Fork 0

Add GDPR Data Processing Agreement as new document type #27

New issue

Closed

opened 2026-04-07 09:00:28 -04:00 by pook · 2 comments

pook commented

2026-04-07 09:00:28 -04:00

Owner

Summary

Add a Data Processing Agreement (DPA) document type to the generation engine. DPAs are required by GDPR Article 28 for any business that uses third-party processors (hosting, analytics, payment providers). This is the #1 most-requested compliance document after privacy policies and ToS.

Implementation

Create a new DPA template in the templates directory following the existing document type pattern (privacy policy, ToS, cookie policy).
The template should accept inputs: company name, processor name, data categories processed, processing purposes, sub-processors list, data retention period, transfer mechanisms (SCCs, adequacy decisions).
Generated sections must include: subject matter and duration, nature and purpose of processing, types of personal data, categories of data subjects, obligations of the processor, obligations of the controller, sub-processing terms, data breach notification (72-hour clause), audit rights, data deletion/return on termination.
Add the DPA option to the generation API endpoint and frontend form selector.
Add at least 3 unit tests covering: successful generation with valid inputs, validation errors for missing required fields, correct section rendering.

Acceptance Criteria

DPA appears as a selectable document type in the UI
POST /api/generate accepts type: 'dpa' and returns a complete DPA document
All required GDPR Article 28 sections are present in output
Input validation rejects requests missing required DPA fields
Unit tests pass

Generated by CEO Planner (priority: 4)

## Summary Add a Data Processing Agreement (DPA) document type to the generation engine. DPAs are required by GDPR Article 28 for any business that uses third-party processors (hosting, analytics, payment providers). This is the #1 most-requested compliance document after privacy policies and ToS. ## Implementation 1. Create a new DPA template in the templates directory following the existing document type pattern (privacy policy, ToS, cookie policy). 2. The template should accept inputs: company name, processor name, data categories processed, processing purposes, sub-processors list, data retention period, transfer mechanisms (SCCs, adequacy decisions). 3. Generated sections must include: subject matter and duration, nature and purpose of processing, types of personal data, categories of data subjects, obligations of the processor, obligations of the controller, sub-processing terms, data breach notification (72-hour clause), audit rights, data deletion/return on termination. 4. Add the DPA option to the generation API endpoint and frontend form selector. 5. Add at least 3 unit tests covering: successful generation with valid inputs, validation errors for missing required fields, correct section rendering. ## Acceptance Criteria - [ ] DPA appears as a selectable document type in the UI - [ ] POST /api/generate accepts `type: 'dpa'` and returns a complete DPA document - [ ] All required GDPR Article 28 sections are present in output - [ ] Input validation rejects requests missing required DPA fields - [ ] Unit tests pass --- *Generated by CEO Planner (priority: 4)*

pook added the

agent-task

label

2026-04-07 09:00:28 -04:00

pook commented

2026-04-08 11:20:00 -04:00

Author

Owner

⚠️ Stale Task Alert — This task has been open for 26h with no associated PR.

Possible causes:

Worker failed to execute (check logs)
Claude CLI produced no changes
Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 26h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook closed this issue

2026-04-08 11:20:00 -04:00

pook commented

2026-04-08 11:20:00 -04:00

Author

Owner

🔒 Auto-closed — This task was open for 26h without producing a PR. The CEO planner will generate a better-scoped replacement if the work is still needed.

— CEO Planner (automated)

🔒 **Auto-closed** — This task was open for 26h without producing a PR. The CEO planner will generate a better-scoped replacement if the work is still needed. *— CEO Planner (automated)*

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#27

No description provided.

Rows
Columns