GDPR / CCPA bundle

The General Data Protection Regulation (Regulation (EU) 2016/679) governs any processing of EU personal data; the California Consumer Privacy Act, as amended by the CPRA (Cal. Civ. Code §1798.100 et seq.) governs California consumers' personal information — including employees' and B2B contacts' — with a distinct category of sensitive personal information and new rules on automated decision-making. When an AI agent reads and writes customer, employee, and prospect data across connected SaaS apps, that is processing attributable to the controller under GDPR and collection, use, and disclosure by the business under CCPA. Every over-broad query, every field returned to the model, every agent-initiated disclosure is a compliance event on that path. This bundle is a starting posture for it: scope each tool call, gate it by identity, minimise what comes back, and block the disclosures the frameworks care about.

These policies support alignment with GDPR & CCPA/CPRA on the MCP path only. They act on the tool calls an AI agent makes through the DTwo gateway; web-UI logins, native-API integrations, and in-app activity are outside their reach by design, and no policy or bundle makes an organization GDPR- or CCPA-compliant. Both frameworks impose obligations — legal bases, contracts, notices, data-subject-request fulfilment, retention, encryption at rest, residency — that no gateway can satisfy. Compliance is a property of your whole program.

What this bundle covers

100 policies across 31 apps, grouped below by the GDPR/CCPA control they support. Every policy is single-purpose and composes with the others on the same pipeline direction. Policy bodies live under apps/; this page only links to them.

The per-decision audit log that records every one of these calls — principal, action, resource, context, decision — is a property of the gateway beneath the bundle, not a policy in it. That record is what supports the accountability and records duties for the agent-mediated slice of traffic: GDPR Art. 5(2)/24 (demonstrability), Art. 30 (records of processing activities), Arts. 33/34 (breach forensics), and the "reasonable security" and audit expectations under CCPA §1798.100(e) and 11 CCR §§7120–7124.

1. Data minimisation — cap the blast radius of a read (Art. 5(1)(c); 11 CCR §7002)

Clamp bulk reads, exports, and search fan-out, and hold agents to read-only or allowlisted queries, so a single call can't harvest a table, a mailbox, or a roster. Personal data must be adequate, relevant, and limited to what is necessary — enforced per call.

2. Egress minimisation — redact PII, sensitive PI, and secrets on the way out (Art. 5(1)(c), Art. 9; §1798.121, §1798.150)

Egress redaction strips personal data, special-category and sensitive-PI patterns (SSNs, financial-account and card numbers, national IDs), and live credentials from responses before an agent carries them into its context or a downstream app. Transform-only where marked — they clean, they don't deny. Reducing what reaches the model directly shrinks the "nonredacted PI exposed" surface that CCPA §1798.150 attaches statutory damages to.

3. Special-category and sensitive-scope fencing (Art. 9, Art. 5(1)(b); §1798.121)

Role-based limits on where an agent can look. HR, payroll, legal, security, and other regulated scopes — folders, tables, schemas, boards, projects, spaces, datasets, channels, directories — are fenced to their owning IdP groups across reads, writes, and search. This keeps special-category data (Art. 9) and sensitive PI (§1798.121) away from agents whose purpose doesn't cover it.

4. Least-privilege by default — data protection by design and default, processing on instructions (Art. 25, Art. 29 / Art. 32(4))

The default posture processes nothing an agent isn't explicitly cleared for. Per-app role gates open writes only to the matching IdP group; field-protection keeps regulated attributes (ownership, consent flags, PII) from silent agent edits. This is Art. 25(2) made concrete for the agent channel, and the technical confinement of an agent to the controller's standing instructions (Art. 29 / Art. 32(4)). By keeping the consequential write behind a human in the matching group, these gates also keep agent workflows from "solely automated" significant decisions (Art. 22; 11 CCR §7200 et seq. — ADMT).

5. Confidentiality and disclosure control — external sends, share links, exfil channels, cross-border flows (Art. 5(1)(f) / Art. 32, Arts. 44/46; §1798.100(e))

The disclosure line, enforced on the agent channel: deny sends and invites to external recipients, downgrade or deny anonymous share links, block warehouse export/unload, and stop org-wide or public publication of personal data. Blocking agent-initiated cross-app and external-domain flows is where the gateway touches Arts. 44/46 on the MCP path.

How bundle membership works

Bundle membership is declared in each policy's policy.md frontmatter (the policy lists bundles: ["gdpr-ccpa"]). This page is a human-readable landing page; the generated manifest.json is the machine-readable source of truth. There is intentionally no separate bundle.json artifact — one source of metadata avoids drift.

The policies compose by direction. The egress redaction policies (theme 2, plus the docusign egress cap) attach to the response pipeline and are transform-only where marked, so they never deny and never collide with the ingress controls. The ingress policies are each single-purpose — a cap, a role gate, a fence, a disclosure guard — so several attach to the same app on the same direction without interfering. Pick a read-only posture or the narrow write controls for an app, not both; combining them is redundant but harmless.

What this bundle does NOT cover

These policies act only on agent traffic over MCP, and only some GDPR/CCPA requirements reduce to a gateway decision. Out of scope by design:

• Legal bases, notices, and consent capture. Establishing a lawful basis (GDPR Art. 6), serving privacy notices, and collecting or honoring consent org-wide are legal and product acts. The gateway can execute a consent-driven restriction if you encode it, but it does not run the consent machinery.
• Data-subject and consumer rights (Arts. 15–21; §1798.105/.106). Access, rectification, erasure, restriction, objection, deletion, and correction happen inside each app and via process. The audit log helps scope the agent-mediated slice of a rights request, but the rights machinery is app and process.
• Storage limitation and retention (Art. 5(1)(e)). Retention schedules live inside each app and in your records policy. Denying agent copy-out limits proliferation into unmanaged stores, but the gateway cannot implement retention.
• Processor and service-provider contracts (Art. 28; §§7050–7051). DPAs and SP/contractor contracts are legal instruments. DTwo evidence supports the "sufficient guarantees" assessment for the agent channel but cannot substitute for the contract.
• DPIAs and risk assessments (Art. 35; 11 CCR §§7150–7157). These are organizational documents. The policies here are exactly the safeguards such an assessment should cite, with logs as evidence they operate — but the assessment itself is process.
• Encryption at rest and data residency. Encryption at rest, and where each SaaS app stores and replicates data, are app and infrastructure concerns. International-transfer instruments (SCCs, adequacy under Arts. 44/46) are legal; the gateway can only block agent-visible flows.
• ADMT notices and opt-out (Art. 22; 11 CCR §7200 et seq.). The role gates in theme 4 keep a human in the loop on consequential writes; the pre-use notice, opt-out plumbing, and the legal scoping judgment are process.
• Web-UI, native-API, and in-app access. A person opening a record in the app's own UI, or a native integration writing to it, never passes through the gateway. Those paths stay governed by the app and your IdP.
• Tenant-specific inputs. Sensitive schema names, folder and board IDs, project keys, channel lists, and corporate-domain allowlists are yours, not ours; supply them at import time. IdP group names in these policies are placeholders — map them to your directory's groups before relying on them.

---

Compliance note. This bundle supports alignment with the cited framework controls on the MCP path only. No policy or bundle makes an organization compliant with any framework; web-UI, native-API, and in-app access are outside the gateway's reach by design. Validate against your own compliance program before relying on it.