GDPR record of processing, DPIA

Part of epic 6213. Child C8 of 9. Depends on C4 (`trust.md` exists) and C5 (risk row `R-PROSPECT-RET` and the trust-request processing exist). ## Original requirement (verbatim) > "Identify which security and compliance certifications Jaah's competitors have — SOC 2, HIPAA, ISO 27001, etc. — and close the gap. Without breaking anything :)" **R5 — GDPR artefacts** (verbatim): - Art. 30 record of processing activities (Jaah as processor, and as controller for its own account data). - A DPIA for the high-risk processing (customer source + transcripts sent to model providers). - Linked from the compliance index; feeds the trust page's GDPR line. ## Scope (architecture §3.5 GDPR) - `docs/compliance/gdpr-ropa.md`: Art. 30(1) (controller: Jaah's own account, billing, marketing-enquiry, sign-up and the trust-document-request processing) and Art. 30(2) (processor: tenant customer source, transcripts, credentials, PII). Each row: purposes, data subjects, data categories, recipients (pointer to `vendor-register.md`), transfers, retention (pointer to `docs/policies/data-classification-retention.md`; prospect rows point at risk row `R-PROSPECT-RET`), security measures (pointer to the policy set). Every cell a pointer or fact — never "TBD", never copied policy prose. - `docs/compliance/gdpr-dpia.md`: customer source and transcripts sent to model providers — necessity and proportionality, risks, mitigations (pointers: redaction, HIPAA bar, retention, vendor DPAs), residual risk, DPO/owner sign-off as owner action `GDPR-OA-1` (owner-action section in that file). - Link both from `docs/compliance/README.md`. - Add to `docs/compliance/public/trust.md` the GDPR line "Record of processing and DPIA maintained; available on request" (links nothing private; `dpia_summary` is already a DocKey from C5). No unfinished marker, existing tokens only (global `is_live()` rule). Credentials & reach: AC12 | nothing beyond the worktree (`tools/check_context.py`, grep, `./dc check full`) | **verified** (worktree-only). AC-X2 | runner's own forge login via `jaah-forge` | **verified**. Out of scope: Do NOT appoint a DPO or sign anything (owner action GDPR-OA-1). Do NOT change retention rules or the data-classification policy's periods. Do NOT change other trust-page lines. Epic-wide (PRD §6, verbatim): "**Do not** obtain, buy, sign or contract anything; **do not** contact outside parties. **Do not** claim any certification as held. **Do not** start FedRAMP, PCI, TISAX, Cyber Essentials, ISO 27017/27018/27701 or CSA STAR work. **Do not** change existing legal pages' text/URLs, the publish switch semantics, or `UNPUBLISHED_SIGNUP_LINKS` / sign-up flow. **Do not** copy SOC 2 policy prose into ISO documents — pointer per row (single-home); no parallel policy set. **Do not** put instance data (people, account ids) in reusable docs — `portfolio/projects/jaah.md` only." Done means: - AC12 (R5) RoPA lists every processing activity with the Art. 30(1)/(2) fields; DPIA covers necessity, risks and mitigations for model-provider processing. → verify: field checklist per row. (Tightened: no blank cell, no TBD — `grep -n 'TBD\|TODO' docs/compliance/gdpr-*.md` = 0; every pointer resolves via `python3 tools/check_context.py`.) - AC11 (R4) for the new GDPR line: No status on the trust page claims a certificate not issued. → verify: the line cross-checked against the RoPA/DPIA files. - Legal pages stay live-capable: existing `is_live` / legal-page tests pass unchanged. - AC-X1 (A3) Nothing breaks: `./dc check full` green on every PR. → verify: gate output. - AC-X2 (A3) Every PR's Jaah Deploy succeeds on dev. → verify: GitHub deploy run status.

Added GDPR RoPA (Art. 30) and model-provider DPIA (GDPR-OA-1), indexed, trust GDPR line added. Full gate green, PR #5392 merged; dev deploy green on next run (first rollout flaked). Deferred: HubSpot vendor row, unclassed data; UI suggestions in report (task create 403).