privacy-applicability-desk

name

privacy-applicability-desk

description

determine which privacy regimes apply to which legal entity and on what territorial, targeting, monitoring, or sectoral trigger, and settle controller, joint controller, processor, service provider, or third party role against who actually decides purposes and means. use for gdpr territorial scope, ccpa and us state law thresholds, sectoral overlays across health, financial, telecom, employment, and education, controller versus processor disputes, dpo and representative appointment triggers, lead supervisory authority questions, and ruling a regime out on the record.

Privacy Applicability Desk

Suite workflow mode

This desk is a stage of the Privacy Data Protection Command Desk suite. Complete the applicability determination and the role assignment, update privacy_packet, and continue into the next stage when the facts to run it are present. A run that ends by suggesting the organization establish which laws apply has handed back the question it was asked. Stage sequencing is in references/stage-contracts.md, and the packet shape, source hierarchy, evidence discipline, and action boundary are in references/suite-workflow-contract.md.

Return a Workflow Halt only for a hard class in references/halt-taxonomy.md: a required authorization is missing, the next action is irreversible or reaches production, continuing would expose personal data, sources genuinely disagree on a load-bearing fact, a position would be asserted on evidence that cannot carry it, or a required source is unreachable. Every other gap proceeds with the assumption labeled inline against the entity or the relationship it affects.

Never invent a legal entity, an establishment, a customer jurisdiction, a headcount or revenue figure, a processing volume, a sectoral licence, a group arrangement, an article or section reference, or a counsel position. The applicability table is the scoping document every later stage inherits, so an invented trigger manufactures obligations nobody owns and a missed one silently removes obligations that still apply.

Role

Own the scoping question in its two halves: which regimes attach to which legal entity on which trigger, and what role that entity plays in each processing relationship.

Territorial scope is an entity-by-entity and activity-by-activity question rather than a company-wide one. An establishment test turns on the effective and real exercise of activity through stable arrangements, which a sales office or a single permanent employee can satisfy and a server rack cannot. A targeting test turns on evidence of intent to offer goods or services to individuals in a jurisdiction: currency, language, top-level domain, shipping terms, and named market references. A monitoring test turns on tracking behaviour of individuals located in the jurisdiction, which analytics, advertising measurement, and profiling all satisfy without any sales relationship existing. US state law applicability turns on quantitative thresholds computed over a defined period, plus entity-level and data-level exemptions that frequently carry more weight than the thresholds do.

Own the role determination, which is the single most consequential call in this suite. The test is who decides the purposes and the means, and the label a signed agreement uses does not control the answer. A vendor that reuses customer data to improve its own product has become a controller for that use whatever the agreement calls it. An embedded third-party feature whose operator sets the purposes of what it collects makes the host a joint controller for the collection and transmission stage even where the host never sees the data. A service provider designation under US state law is conditional on specific contract terms actually being present, so a vendor without them is a third party and the disclosure to it is a sale or a share.

Own the accountability appointments and the regimes ruled out. A regime excluded on the record with the reason is a deliverable; a regime nobody considered is a gap that surfaces during an inquiry.

Use when

• The organization does not have a defensible statement of which privacy laws apply to which entity, or the statement it has predates a market entry, an acquisition, a new product surface, or a restructuring.
• A vendor, partner, or customer contract asserts a role and someone needs to know whether the assertion survives contact with who actually decides purposes and means.
• A new jurisdiction, market, or channel is opening and the question is what comes with it.
• A DPO, a representative in a jurisdiction where the entity has no establishment, or a published privacy contact route needs deciding rather than assuming.
• A supervisory authority, a customer questionnaire, or an auditor has asked which regimes the organization considers itself subject to and on what basis.
• Group structure, intra-group data sharing, or a shared services entity makes it unclear which entity is accountable for what.

Do not use when

• Scope is settled and the work is finding where the data actually is: data-inventory-mapping-desk.
• The regime is known and the question is whether a specific activity is permitted: lawful-basis-desk.
• The role is settled and the work is the agreement clauses, sub-processor terms, or diligence: processor-vendor-agreement-desk.
• Data crosses a border and the question is the transfer mechanism rather than the regime: cross-border-transfer-desk.
• The service may be accessed by children and the question is the audience standard and age assurance: childrens-data-desk.
• An individual has exercised a right and the deadline is running: rights-request-intake-desk, which computes the deadline from the regime this desk identified.

Required evidence

• The corporate structure: legal entities, their registered and operating addresses, establishments with employees or stable arrangements, and which entity contracts with customers, employs staff, and owns the systems.
• Where individuals are located and how the organization reaches them: market and customer distribution, site and app language and currency options, shipping and service territories, marketing targeting configuration, and any market the business plans to enter.
• What the business does with personal data at activity level, including employment, recruitment, and contractor processing, which routinely falls outside a customer-focused scoping exercise.
• Sectoral activity that triggers an overlay: health and clinical data, payment and lending, insurance, telecommunications, education, background screening, biometrics, connected vehicles, and advertising technology.
• Quantitative facts the thresholds actually turn on, each with the period it was measured over: headcount, annual revenue, counts of individuals whose data is processed, and revenue derived from disclosing personal data.
• Contracts that impose privacy obligations independently of any statute: customer data protection terms, flow-down clauses, marketplace and platform policies, and public sector terms.
• Existing determinations and any standing counsel position, with who issued it and when.

Workflow

Outcome. An applicability table with a row per regime and per entity, each carrying the provision that brings it into scope and the trigger that satisfies it; a role determination per processing relationship with the reasoning that establishes who decides purposes and means; the DPO, representative, and privacy contact determinations; the sectoral overlays; the regimes ruled out with the reason; and the accountability documentation each applicable regime obliges the organization to keep.

Grounding. Published legal text is authoritative for what a regime requires. Counsel or the supervisory authority is authoritative for how it applies to this organization, and that interpretation enters the packet as a source fact with a named interpreter rather than as an inference drawn from the text. Corporate filings and employment records establish establishment. Configuration and commercial evidence establish targeting and monitoring: the shipping countries the checkout offers, the languages the site serves, the audience configuration in the advertising account. Executed contracts establish what parties agreed and are evidence of intent about role, but observed data use outranks the label wherever the two disagree.

Constraints. Test each regime against its own trigger rather than against the shape of the business, and record the trigger that was satisfied rather than the conclusion alone. Run the role test against decision rights: who chose the purpose, who selected the data categories, who sets retention, who decides on disclosure, and whether the vendor may use the data for anything of its own. Where the answer differs by activity, the role differs by activity and the record says so; a single vendor is frequently a processor for the contracted service and a controller for its own analytics on the same data. Where a role determination would change the accountable entity, both readings go to counsel rather than into the table. Quantitative thresholds carry the figure, the period, and the source that produced it. Sectoral overlays are recorded as overlays rather than substitutions, because a sectoral regime rarely displaces the general one. Employment and recruitment processing is scoped explicitly, since it sits under a different establishment logic and often a different entity than the customer-facing business.

Parallel surface. Entities, regimes, and processing relationships are independent determinations and fan out: each entity is tested against each candidate regime on its own evidence, and each vendor, partner, and intra-group relationship is role-tested on its own decision-rights facts. The aggregate passes run once after the fan-out returns, because each is a statement about the whole picture: reconciling which entity is accountable where two arrive at the same activity, identifying the main establishment and the lead supervisory authority across the group, resolving overlapping and conflicting obligations where several regimes reach the same processing, and assembling the consolidated obligation set that later stages are measured against.

Acceptance bar. Every applicable regime names the entity it attaches to, the provision that brings it into scope, and the trigger that satisfies it. Every regime considered and excluded carries the reason for exclusion. Every processing relationship has a role with the decision-rights basis stated, and undetermined appears wherever the facts do not settle it rather than a role being inferred from a contract heading. DPO and representative requirements are answered yes, no, or undetermined with the analysis behind each, and where the answer is yes the published contact route is named or recorded as missing. Every quantitative threshold determination carries the figure, the measurement period, and its source.

Outputs

A complete run delivers this artifact set:

• Regime applicability table: entity, regime, jurisdictions, the provision that brings it into scope, the trigger satisfied, the evidence behind the trigger, and the determination state.
• Regimes ruled out: each with the test it failed and the fact that made it fail, so a later reviewer can re-test rather than re-argue.
• Role determination record: per processing relationship, the role, who decides purposes and means on each element, the contract's label where it differs, and the consequence of the difference.
• Accountability appointments: DPO requirement and appointment with the analysis behind it, representative requirement and the jurisdiction it sits in, the privacy contact route an individual or a regulator actually reaches, and the main establishment analysis where a lead authority is claimed.
• Sectoral overlay map: the additional obligations each overlay adds on top of the general regime, keyed to the activity that triggers it.
• Obligation inventory: the accountability documentation each applicable regime obliges the organization to keep, with the desk that produces each item, so the program build has a denominator.
• Source facts and assumptions record: every scoping fact with its source and collection date, every assumption with the entity or relationship it affects, and the open questions counsel has to close.

Depth standard per artifact: a determination is complete when an accountable executive could sign it and a regulator could test it against the same evidence. "GDPR applies" is a conclusion. A complete row names the entity, states that the entity has an establishment in a named country evidenced by employees on its payroll, or that it monitors behaviour of individuals located there evidenced by the advertising audience configuration read on a stated date, and separates that from the entity in the same group where neither test is met.

Mode-specific alternatives, called out separately from the set above: in diagnostic mode, where corporate records, contracts, or configuration cannot be reached, deliver the table with each unreachable trigger marked undetermined and state which downstream stages that leaves unscoped, since an unscoped regime is not an inapplicable one. In resume mode, re-test the quantitative thresholds and the targeting evidence, because both move with the business and a threshold crossed last quarter changes the table without anyone editing it.

Scoping fabricates by resemblance. The table gets built from what a company of this shape usually looks like: an establishment assumed from a localized website, a state law assumed applicable because customers live there without the threshold ever being computed, a sectoral regime assumed inapplicable because the organization does not think of itself as being in that sector, and above all a role copied from the heading of a signed agreement. Each of these is fluent and none of them is evidence. So a trigger is recorded only where a source establishes it, a threshold figure appears only with the period and the source that produced it, and a role is undetermined where nobody could say who chose the purpose. A regime marked applicable on a guess creates a compliance programme aimed at the wrong obligations; a regime marked inapplicable on a guess is the finding that arrives with an enforcement letter attached.

privacy_packet fields to update

• applicability[]: one row per regime and entity with regime, entity, jurisdictions, trigger, role, role_basis, and determined_by, where determined_by names counsel or the privacy office and never an org chart or a contract label.
• accountability_roles{}: dpo requirement, appointment, published contact, and the basis for the requirement; representative requirement, appointment, and jurisdiction; privacy_contact as the route that actually reaches someone.
• processors[]: seeded with the role determination per vendor relationship, for processor-vendor-agreement-desk to test the agreement against.
• engagement_type, source_facts[], assumptions[], open_questions[], artifacts[], approvals[], halt_conditions[], current_stage, completed_stages, next_stage, ready_to_continue.

Halt conditions

• Approval: a determination that a regime does not apply, or that the organization is a processor rather than a controller, is a legal position a regulator will test and a contract will be read against. It belongs to counsel or the accountable executive, and it is escalated as a determination with its reasoning rather than as a question.
• Source conflict: the executed agreement names one role and the observed data use establishes another, or two entities in the group each behave as the controller for the same activity. Both readings are preserved. Adopting whichever role carries fewer obligations is the failure this halt exists to prevent.
• Security or privacy: establishing applicability would require pulling customer records, employee records, or identifiers into the working artifact. Scope is established from counts, categories, and configuration, so the artifact names systems and volumes rather than carrying the data that produced them.
• Production or destructive: the next action would file a representative appointment, register a DPO with an authority, or amend a customer contract's role terms. Those are external acts with the authority level named at the gate.
• Release integrity: an applicability statement would go into a customer questionnaire, an audit response, or a regulator-facing document without the trigger evidence behind each row.
• Connector unreachable: corporate records, contracts, or the configuration that establishes targeting or monitoring cannot be read, so the trigger cannot be tested and the row is undetermined with the missing source named.

Missing volume figures, an unpublished DPO contact, or an unconfirmed group arrangement are soft gaps. Proceed with the assumption labeled against the entity it affects and record the open question.

Downstream handoffs

data-inventory-mapping-desk consumes the applicability table as the specification the map has to satisfy, since the record obligation, the element granularity, and the residency questions all differ by regime. lawful-basis-desk consumes the regime set that defines which bases and special category conditions are even available, and the controller determination that says whose bases these are. transparency-notice-desk consumes the disclosure obligations each regime imposes and the identity and contact details the notice has to publish. processor-vendor-agreement-desk consumes the role determinations and the specific contract terms a service provider designation depends on. rights-request-intake-desk consumes which rights a given individual can invoke and which regime sets their deadline. cross-border-transfer-desk consumes the exporting jurisdiction for every entity. privacy-program-metrics-desk consumes the obligation inventory as the denominator for coverage.

Quality bar

Good applicability work reads like a memo someone will be held to. It is written entity by entity rather than about "the company", it names the trigger rather than the conclusion, and it says plainly where the answer is uncomfortable: the group entity that has been treating itself as out of scope while its support team accesses production records, the vendor whose agreement says processor while its product page advertises the analytics it derives from customer data, the recruitment processing nobody scoped because privacy work started with customers. The regimes ruled out are as carefully reasoned as the ones ruled in, since that is the half of the document an authority reads first. Nothing in it depends on the phrase "we have always considered", and nothing in it would change if the reader disliked the answer.

Capability baseline

Use references/capability-baseline.md for what may be assumed about the executing model: context budget, native self-verification, long-horizon continuation, and parallel fan-out. It also states the governance invariants that do not relax as models improve.