GDPR coverage map
Applies to The Fabrica v0.1.2. Documentation source:
1ee1bc9cb661, including post-release documentation corrections.
What a questionnaire actually asks for
A real enterprise customer’s GDPR/security questionnaire asks ~40-80 questions across 8-10 categories. Each category needs both:
- Running code — something that demonstrably enforces the right at the SQL / API layer.
- Documentation — a markdown / PDF describing the procedure, contact, retention, sub-processors, etc.
Most boilerplates ship #1 partially and skip #2 entirely. The factory ships both.
Coverage map
| GDPR Article | Code in factory | Document in factory | Buyer action required |
|---|---|---|---|
| Art. 5(1)(c) data minimisation | User model intentionally minimal (no name/phone/address) | RoPA §2.x lists every column collected | Audit your _domain/ additions for over-collection |
| Art. 7 consent | marketing_consent_given + HMAC unsubscribe + cookie banner 3-tier + Clerk sign-up-form capture | RoPA §2.4 + cookie banner copy | Update copy; optionally add a consent checkbox to your Clerk <SignUp> (writes unsafe_metadata.marketing_consent) |
| Art. 13/14 info notices | Privacy page route (i18n) | frontend/.../(marketing)/privacy/page.tsx | Replace {PROJECT_NAME} placeholders |
| Art. 15 right of access | GET /me/export | RoPA §2.x ties to endpoint | None — works as-is |
| Art. 16 rectification | PATCH /me/* endpoints | RoPA reference | Document in your customer-facing privacy page |
| Art. 17 right to erasure | User.deleted_at + account_deletion worker (30d grace + hard-delete) | RoPA §2.1 | None — works as-is |
| Art. 20 data portability | GET /me/export returns User + Subs + CreditTx + AuditLog as JSON | RoPA §2.1 | Extend response if you add domain tables |
| Art. 28 processor obligations | n/a (legal doc) | docs/compliance/dpa-template.md | Fill {PLACEHOLDERS}, lawyer review |
| Art. 30 records of processing | Operational AuditLog table | docs/compliance/ropa-register.md | Add your domain rows |
| Art. 32 security measures | All of services/email.py retry, unsubscribe.py HMAC, middleware/security_headers.py, TLS-required Redis, etc. | DPA Schedule 2 + threat model | Match Schedule 2 against your actual production posture |
| Art. 33 breach notification | n/a (operational) | docs/compliance/breach-notification-plan.md | Fill role names + DPA URL for your jurisdiction |
| Art. 35 DPIA | n/a (decision tool) | docs/compliance/dpia-trigger-checklist.md | Re-run when adding features that touch profiling / biometrics / minors / etc. |
| Art. 44-46 transfers | Default deploy region fra (Frankfurt); sub-processor SCCs documented | DPA §8 + subprocessors page | Verify each sub-processor’s SCCs are signed |
Where the factory stands honestly: the rows above are the ones the shipped code and documents already answer. Everything outside them needs buyer-specific decisions — jurisdiction, lawyer review, DPO appointment, sub-processor choices — that code cannot make for you. How much of any given questionnaire that covers depends entirely on the questionnaire, so this page does not put a number on it.
What this bundle DOESN’T cover
Be explicit with customers about what’s NOT shipped:
- SOC 2 Type II / ISO 27001: certifications, not boilerplate artifacts. Budget €15-40k + 6 months for SOC 2 Type II via Drata / Vanta / Sprinto.
- HIPAA / FINMA / PSD2 / etc.: industry-specific compliance not covered.
- DPO appointment: required (Art. 37) if you do large-scale systematic monitoring or large-scale special-category processing. Most early-stage SaaS doesn’t need one.
- Privacy Shield successor: as of 2026, EU-US Data Privacy Framework. Each sub-processor needs to be DPF-certified or have SCCs. The factory’s subprocessors page documents which.
- Cookie consent in non-EU jurisdictions (California CPRA, Brazil LGPD, etc.): the 3-tier banner is GDPR-shaped. Other regions may need separate flows.
Provenance. Documentation source: 1ee1bc9cb6619c19f57766731e7884b37f515dc9 (main).
Extracted from docs/recipes/gdpr-compliance-bundle.md.
That commit is later than the release these pages describe: it carries documentation corrections made after thefabrica-v0.1.2 went out. Nothing that changes how the product behaves landed between the two, which is what makes naming that version honest.