M24: implement privacy governance

docs/18-privacy-governance.md

@@ -0,0 +1,50 @@
+# Privacy and data governance
+
+## Scope and ownership
+
+MobilityOps stores operational users, customers, bookings, vehicle inspections,
+maintenance, data-quality issues, workflow state and audit events. The deployed demo
+contains synthetic data only. Before introducing real data, the deploying organisation
+must document its controller/processor roles, lawful bases, contact point and approved
+retention values. Operations Managers are the only role permitted to export or anonymise.
+
+## Retention policy
+
+- Customer PII may be anonymised only when no reserved or active booking exists and the
+  newest booking is older than `PRIVACY_MINIMUM_BOOKING_RETENTION_DAYS` (default 30).
+- Audit events are configured for 2,555 days by default. They are immutable operational
+  evidence; changing this period requires legal approval and a separate, audited purge
+  implementation. MobilityOps reports the policy but never silently deletes audit data.
+- Database backups default to 30 days with at least seven newest recovery points. A
+  configured secondary mount must follow the same policy.
+- Logs are bounded by Docker rotation. They must not contain request bodies, passwords,
+  OIDC tokens or customer fields.
+
+## Data-subject request procedure
+
+1. Verify the requester's identity outside MobilityOps and record the case reference.
+2. In **Privacy management**, download the customer JSON. The export action is audited.
+3. Review active/recent booking blockers and applicable legal retention obligations.
+4. Enter a reason and the exact customer reference to anonymise. The operation is
+   irreversible and row-locked. It clears name, email, phone, address and birth date but
+   preserves the stable reference and operational bookings so financial/operational
+   evidence is not corrupted.
+5. Verify the resulting audit event. Its before/after payload records only anonymisation
+   state; erased PII is deliberately not copied into the audit log.
+6. Handle verified backups according to their bounded retention; never mutate individual
+   dump files.
+
+## Audit export and access review
+
+Audit CSV exports are manager-only, limited to a maximum 90-day range and a configurable
+row cap. Every export is itself audited. Review manager accounts, external OIDC bindings,
+failed sign-ins, privacy exports and anonymisations periodically. Deactivate access at the
+canonical MobilityOps user record; this invalidates subsequent operational requests.
+
+## Incident handling
+
+Preserve relevant JSON logs, correlation IDs and audit exports; do not overwrite the
+database or backups. Rotate affected secrets, disable OIDC or external integrations when
+needed, assess notification obligations and restore only through the guarded runbook.
+Record all incident decisions outside the application in the organisation's incident
+system.