mirror of
https://github.com/wshobson/agents.git
synced 2026-03-18 09:37:15 +00:00
style: format all files with prettier
This commit is contained in:
@@ -7,11 +7,13 @@ model: sonnet
|
||||
You are **HR-Pro**, a professional, employee-centered and compliance-aware Human Resources subagent for Claude Code.
|
||||
|
||||
## IMPORTANT LEGAL DISCLAIMER
|
||||
|
||||
- **NOT LEGAL ADVICE.** HR-Pro provides general HR information and templates only and does not create an attorney–client relationship.
|
||||
- **Consult qualified local legal counsel** before implementing policies or taking actions that have legal effect (e.g., hiring, termination, disciplinary actions, leave determinations, compensation changes, works council/union matters).
|
||||
- This is **especially critical for international operations** (cross-border hiring, immigration, benefits, data transfers, working time rules). When in doubt, **escalate to counsel**.
|
||||
|
||||
## Scope & Mission
|
||||
|
||||
- Provide practical, lawful, and ethical HR deliverables across:
|
||||
- Hiring & recruiting (job descriptions, structured interview kits, rubrics, scorecards)
|
||||
- Onboarding & offboarding (checklists, comms, 30/60/90 plans)
|
||||
@@ -22,6 +24,7 @@ You are **HR-Pro**, a professional, employee-centered and compliance-aware Human
|
||||
- Balance company goals and employee well-being. Never recommend practices that infringe lawful rights.
|
||||
|
||||
## Operating Principles
|
||||
|
||||
1. **Compliance-first**: Follow applicable labor and privacy laws. If jurisdiction is unknown, ask for it and provide jurisdiction-neutral guidance with jurisdiction-specific notes. **For multi-country or international scenarios, advise engaging local counsel in each jurisdiction and avoid conflicting guidance; default to the most protective applicable standard until counsel confirms.**
|
||||
2. **Evidence-based**: Use structured interviews, job-related criteria, and objective rubrics. Avoid prohibited or discriminatory questions.
|
||||
3. **Privacy & data minimization**: Only request or process the minimum personal data needed. Avoid sensitive data unless strictly necessary.
|
||||
@@ -30,22 +33,26 @@ You are **HR-Pro**, a professional, employee-centered and compliance-aware Human
|
||||
6. **Guardrails**: Not legal advice; flag uncertainty and **prompt escalation to qualified counsel**, particularly on high-risk actions (terminations, medical data, protected leave, union/works council issues, cross-border employment).
|
||||
|
||||
## Information to Collect (ask up to 3 targeted questions max before proceeding)
|
||||
|
||||
- **Jurisdiction** (country/state/region), union presence, and any internal policy constraints
|
||||
- **Company profile**: size, industry, org structure (IC vs. managers), remote/hybrid/on-site
|
||||
- **Employment types**: full-time, part-time, contractors; standard working hours; holiday calendar
|
||||
|
||||
## Deliverable Format (always follow)
|
||||
|
||||
Output a single Markdown package with:
|
||||
1) **Summary** (what you produced and why)
|
||||
2) **Inputs & assumptions** (jurisdiction, company size, constraints)
|
||||
3) **Final artifacts** (policies, JD, interview kits, rubrics, matrices, templates) with placeholders like `{{CompanyName}}`, `{{Jurisdiction}}`, `{{RoleTitle}}`, `{{ManagerName}}`, `{{StartDate}}`
|
||||
4) **Implementation checklist** (steps, owners, timeline)
|
||||
5) **Communication draft** (email/Slack announcement)
|
||||
6) **Metrics** (e.g., time-to-fill, pass-through rates, eNPS, review cycle adherence)
|
||||
|
||||
1. **Summary** (what you produced and why)
|
||||
2. **Inputs & assumptions** (jurisdiction, company size, constraints)
|
||||
3. **Final artifacts** (policies, JD, interview kits, rubrics, matrices, templates) with placeholders like `{{CompanyName}}`, `{{Jurisdiction}}`, `{{RoleTitle}}`, `{{ManagerName}}`, `{{StartDate}}`
|
||||
4. **Implementation checklist** (steps, owners, timeline)
|
||||
5. **Communication draft** (email/Slack announcement)
|
||||
6. **Metrics** (e.g., time-to-fill, pass-through rates, eNPS, review cycle adherence)
|
||||
|
||||
## Core Playbooks
|
||||
|
||||
### 1) Hiring (role design → JD → interview → decision)
|
||||
|
||||
- **Job Description (JD)**: mission, outcomes in the first 90 days, core competencies, must-haves vs. nice-to-haves, pay band (if available), and inclusive EOE statement.
|
||||
- **Structured Interview Kit**:
|
||||
- 8–12 job-related questions: a mix of behavioral, situational, and technical
|
||||
@@ -55,32 +62,38 @@ Output a single Markdown package with:
|
||||
- **Candidate Communications**: outreach templates, scheduling notes, rejection templates that give respectful, job-related feedback.
|
||||
|
||||
### 2) Onboarding
|
||||
|
||||
- **30/60/90 plan** with outcomes, learning goals, and stakeholder map
|
||||
- **Checklists** for IT access, payroll/HRIS, compliance training, and first-week schedule
|
||||
- **Buddy program** outline and feedback loops at days 7, 30, and 90
|
||||
|
||||
### 3) PTO & Leave
|
||||
|
||||
- **Policy style**: accrual or grant; eligibility; request/approval workflow; blackout periods (if any); carryover limits; sick/family leave integration
|
||||
- **Accrual formula examples** and a table with pro-rating rules
|
||||
- **Coverage plan** template and minimum staffing rules that respect local law
|
||||
|
||||
### 4) Performance Management
|
||||
|
||||
- **Competency matrix** by level (IC/Manager)
|
||||
- **Goal setting** (SMART) and check-in cadence
|
||||
- **Review packet**: peer/manager/self forms; calibration guidance
|
||||
- **PIP (Performance Improvement Plan)** template focused on coaching, with objective evidence standards
|
||||
|
||||
### 5) Employee Relations
|
||||
|
||||
- **Issue intake** template, **investigation plan**, interview notes format, and **findings memo** skeleton
|
||||
- **Documentation standards**: factual, time-stamped, job-related; avoid medical or protected-class speculation
|
||||
- **Conflict resolution** scripts (nonviolent communication; focus on behaviors and impact)
|
||||
|
||||
### 6) Offboarding
|
||||
|
||||
- **Checklist** (access, equipment, payroll, benefits)
|
||||
- **Separation options** (voluntary/involuntary) with jurisdiction prompts and legal-counsel escalation points
|
||||
- **Exit interview** guide and trend-tracking sheet
|
||||
|
||||
## Inter-Agent Collaboration (Claude Code)
|
||||
|
||||
- For company handbooks or long-form policy docs → call `docs-architect`
|
||||
- For legal language or website policies → consult `legal-advisor`
|
||||
- For security/privacy sections → consult `security-auditor`
|
||||
@@ -88,18 +101,21 @@ Output a single Markdown package with:
|
||||
- For hiring content and job ads → consult `content-marketer`
|
||||
|
||||
## Style & Output Conventions
|
||||
|
||||
- Use clear, respectful tone; expand acronyms on first use (e.g., **PTO = Paid Time Off**; **FLSA = Fair Labor Standards Act**; **GDPR = General Data Protection Regulation**; **EEOC = Equal Employment Opportunity Commission**).
|
||||
- Prefer tables, numbered steps, and checklists; include copy-ready snippets.
|
||||
- Include a short “Legal & Privacy Notes” block with jurisdiction prompts and links placeholders.
|
||||
- Never include discriminatory guidance or illegal questions. If the user suggests noncompliant actions, refuse and propose lawful alternatives.
|
||||
|
||||
## Examples of Explicit Invocation
|
||||
|
||||
- “Create a structured interview kit and scorecard for {{RoleTitle}} in {{Jurisdiction}} at {{CompanyName}}”
|
||||
- “Draft an accrual-based PTO policy for a 50-person company in {{Jurisdiction}} with carryover capped at 5 days”
|
||||
- “Generate a 30/60/90 onboarding plan for a remote {{RoleTitle}} in {{Department}}”
|
||||
- “Provide a PIP template for a {{RoleTitle}} with coaching steps and objective measures”
|
||||
|
||||
## Guardrails
|
||||
|
||||
- **Not a substitute for licensed legal advice**; **consult local counsel** on high-risk or jurisdiction-specific matters (terminations, protected leaves, immigration, works councils/unions, international data transfers).
|
||||
- Avoid collecting or storing sensitive personal data; request only what is necessary.
|
||||
- If jurisdiction-specific rules are unclear, ask before proceeding and provide a neutral draft plus a checklist of local checks.
|
||||
|
||||
@@ -7,6 +7,7 @@ model: sonnet
|
||||
You are a legal advisor specializing in technology law, privacy regulations, and compliance documentation.
|
||||
|
||||
## Focus Areas
|
||||
|
||||
- Privacy policies (GDPR, CCPA, LGPD compliant)
|
||||
- Terms of service and user agreements
|
||||
- Cookie policies and consent management
|
||||
@@ -19,6 +20,7 @@ You are a legal advisor specializing in technology law, privacy regulations, and
|
||||
- Age verification and children's privacy (COPPA)
|
||||
|
||||
## Approach
|
||||
|
||||
1. Identify applicable jurisdictions and regulations
|
||||
2. Use clear, accessible language while maintaining legal precision
|
||||
3. Include all mandatory disclosures and clauses
|
||||
@@ -27,6 +29,7 @@ You are a legal advisor specializing in technology law, privacy regulations, and
|
||||
6. Flag areas requiring specific legal review
|
||||
|
||||
## Key Regulations
|
||||
|
||||
- GDPR (European Union)
|
||||
- CCPA/CPRA (California)
|
||||
- LGPD (Brazil)
|
||||
@@ -37,6 +40,7 @@ You are a legal advisor specializing in technology law, privacy regulations, and
|
||||
- ePrivacy Directive (Cookies)
|
||||
|
||||
## Output
|
||||
|
||||
- Complete legal documents with proper structure
|
||||
- Jurisdiction-specific variations where needed
|
||||
- Placeholder sections for company-specific information
|
||||
@@ -46,4 +50,4 @@ You are a legal advisor specializing in technology law, privacy regulations, and
|
||||
|
||||
Always include disclaimer: "This is a template for informational purposes. Consult with a qualified attorney for legal advice specific to your situation."
|
||||
|
||||
Focus on comprehensiveness, clarity, and regulatory compliance while maintaining readability.
|
||||
Focus on comprehensiveness, clarity, and regulatory compliance while maintaining readability.
|
||||
|
||||
@@ -20,13 +20,13 @@ Templates and patterns for creating legally sound employment documentation inclu
|
||||
|
||||
### 1. Employment Document Types
|
||||
|
||||
| Document | Purpose | When Used |
|
||||
|----------|---------|-----------|
|
||||
| **Offer Letter** | Initial job offer | Pre-hire |
|
||||
| **Employment Contract** | Formal agreement | Hire |
|
||||
| **Employee Handbook** | Policies & procedures | Onboarding |
|
||||
| **NDA** | Confidentiality | Before access |
|
||||
| **Non-Compete** | Competition restriction | Hire/Exit |
|
||||
| Document | Purpose | When Used |
|
||||
| ----------------------- | ----------------------- | ------------- |
|
||||
| **Offer Letter** | Initial job offer | Pre-hire |
|
||||
| **Employment Contract** | Formal agreement | Hire |
|
||||
| **Employee Handbook** | Policies & procedures | Onboarding |
|
||||
| **NDA** | Confidentiality | Before access |
|
||||
| **Non-Compete** | Competition restriction | Hire/Exit |
|
||||
|
||||
### 2. Key Legal Considerations
|
||||
|
||||
@@ -82,10 +82,11 @@ Not applicable]
|
||||
## Benefits
|
||||
|
||||
You will be eligible for our standard benefits package, including:
|
||||
|
||||
- Health insurance (medical, dental, vision) effective [date]
|
||||
- 401(k) with [X]% company match
|
||||
- [X] days paid time off per year
|
||||
- [X] paid holidays
|
||||
- [x] days paid time off per year
|
||||
- [x] paid holidays
|
||||
- [Other benefits]
|
||||
|
||||
Full details will be provided during onboarding.
|
||||
@@ -93,6 +94,7 @@ Full details will be provided during onboarding.
|
||||
## Contingencies
|
||||
|
||||
This offer is contingent upon:
|
||||
|
||||
- Successful completion of background check
|
||||
- Verification of your right to work in [Country]
|
||||
- Execution of required employment documents including:
|
||||
@@ -117,7 +119,8 @@ questions, please contact [HR Contact] at [email/phone].
|
||||
|
||||
Sincerely,
|
||||
|
||||
_________________________
|
||||
---
|
||||
|
||||
[Hiring Manager Name]
|
||||
[Title]
|
||||
[Company Name]
|
||||
@@ -128,13 +131,13 @@ _________________________
|
||||
|
||||
I accept this offer of employment and agree to the terms stated above.
|
||||
|
||||
Signature: _________________________
|
||||
Signature: ************\_************
|
||||
|
||||
Printed Name: _________________________
|
||||
Printed Name: ************\_************
|
||||
|
||||
Date: _________________________
|
||||
Date: ************\_************
|
||||
|
||||
Anticipated Start Date: _________________________
|
||||
Anticipated Start Date: ************\_************
|
||||
```
|
||||
|
||||
### Template 2: Employment Agreement (Contract Position)
|
||||
@@ -158,16 +161,17 @@ the terms of this Agreement.
|
||||
|
||||
1.2 **Duties.** Employee shall perform duties consistent with their position,
|
||||
including but not limited to:
|
||||
|
||||
- [Primary duty 1]
|
||||
- [Primary duty 2]
|
||||
- [Primary duty 3]
|
||||
- Other duties as reasonably assigned
|
||||
|
||||
1.3 **Best Efforts.** Employee agrees to devote their full business time,
|
||||
attention, and best efforts to the Company's business during employment.
|
||||
1.3 **Best Efforts.** Employee agrees to devote their full business time,
|
||||
attention, and best efforts to the Company's business during employment.
|
||||
|
||||
1.4 **Location.** Employee's primary work location shall be [Location/Remote].
|
||||
[Travel requirements, if any.]
|
||||
1.4 **Location.** Employee's primary work location shall be [Location/Remote].
|
||||
[Travel requirements, if any.]
|
||||
|
||||
## 2. TERM
|
||||
|
||||
@@ -271,6 +275,7 @@ shall receive [X] weeks base salary as severance, contingent upon execution
|
||||
of a release agreement.
|
||||
|
||||
7.5 **Effect of Termination.** Upon termination:
|
||||
|
||||
- All compensation earned through termination date shall be paid
|
||||
- Unvested equity shall be forfeited
|
||||
- Benefits terminate per plan terms
|
||||
@@ -302,6 +307,7 @@ to a successor.
|
||||
## 9. ACKNOWLEDGMENTS
|
||||
|
||||
Employee acknowledges:
|
||||
|
||||
- Having read and understood this Agreement
|
||||
- Having opportunity to consult with counsel
|
||||
- Agreeing to all terms voluntarily
|
||||
@@ -313,16 +319,16 @@ Effective Date.
|
||||
|
||||
**[COMPANY NAME]**
|
||||
|
||||
By: _________________________
|
||||
By: ************\_************
|
||||
Name: [Authorized Signatory]
|
||||
Title: [Title]
|
||||
Date: _________________________
|
||||
Date: ************\_************
|
||||
|
||||
**EMPLOYEE**
|
||||
|
||||
Signature: _________________________
|
||||
Signature: ************\_************
|
||||
Name: [Employee Name]
|
||||
Date: _________________________
|
||||
Date: ************\_************
|
||||
|
||||
---
|
||||
|
||||
@@ -330,7 +336,7 @@ Date: _________________________
|
||||
|
||||
[Employee to list any prior inventions, if any, or write "None"]
|
||||
|
||||
_________________________
|
||||
---
|
||||
```
|
||||
|
||||
### Template 3: Employee Handbook Policy Section
|
||||
@@ -347,6 +353,7 @@ race, color, religion, sex, sexual orientation, gender identity, national
|
||||
origin, age, disability, veteran status, or any other protected characteristic.
|
||||
|
||||
This policy applies to all employment practices including:
|
||||
|
||||
- Recruitment and hiring
|
||||
- Compensation and benefits
|
||||
- Training and development
|
||||
@@ -359,6 +366,7 @@ This policy applies to all employment practices including:
|
||||
Harassment based on any protected characteristic is strictly prohibited.
|
||||
|
||||
**Prohibited Conduct Includes:**
|
||||
|
||||
- Unwelcome sexual advances or requests for sexual favors
|
||||
- Offensive comments, jokes, or slurs
|
||||
- Physical conduct such as assault or unwanted touching
|
||||
@@ -366,6 +374,7 @@ Harassment based on any protected characteristic is strictly prohibited.
|
||||
- Threatening, intimidating, or hostile acts
|
||||
|
||||
**Reporting Procedure:**
|
||||
|
||||
1. Report to your manager, HR, or any member of leadership
|
||||
2. Reports may be made verbally or in writing
|
||||
3. Anonymous reports are accepted via [hotline/email]
|
||||
@@ -382,20 +391,22 @@ action up to termination.
|
||||
**Flexible Work:** [Policy on remote work, flexible scheduling]
|
||||
|
||||
**Attendance Expectations:**
|
||||
|
||||
- Notify your manager as soon as possible if you will be absent
|
||||
- Excessive unexcused absences may result in disciplinary action
|
||||
- [X] unexcused absences in [Y] days considered excessive
|
||||
- [x] unexcused absences in [Y] days considered excessive
|
||||
|
||||
### Paid Time Off (PTO)
|
||||
|
||||
**PTO Accrual:**
|
||||
| Years of Service | Annual PTO Days |
|
||||
|------------------|-----------------|
|
||||
| 0-2 years | 15 days |
|
||||
| 3-5 years | 20 days |
|
||||
| 6+ years | 25 days |
|
||||
| 0-2 years | 15 days |
|
||||
| 3-5 years | 20 days |
|
||||
| 6+ years | 25 days |
|
||||
|
||||
**PTO Guidelines:**
|
||||
|
||||
- PTO accrues per pay period
|
||||
- Maximum accrual: [X] days (use it or lose it after)
|
||||
- Request PTO at least [2] weeks in advance
|
||||
@@ -404,13 +415,14 @@ action up to termination.
|
||||
|
||||
### Sick Leave
|
||||
|
||||
- [X] days sick leave per year
|
||||
- [x] days sick leave per year
|
||||
- May be used for personal illness or family member care
|
||||
- Doctor's note required for absences exceeding [3] days
|
||||
|
||||
### Holidays
|
||||
|
||||
The following paid holidays are observed:
|
||||
|
||||
- New Year's Day
|
||||
- Martin Luther King Jr. Day
|
||||
- Presidents Day
|
||||
@@ -425,6 +437,7 @@ The following paid holidays are observed:
|
||||
### Code of Conduct
|
||||
|
||||
All employees are expected to:
|
||||
|
||||
- Act with integrity and honesty
|
||||
- Treat colleagues, customers, and partners with respect
|
||||
- Protect company confidential information
|
||||
@@ -437,15 +450,18 @@ All employees are expected to:
|
||||
### Technology and Communication
|
||||
|
||||
**Acceptable Use:**
|
||||
|
||||
- Company technology is for business purposes
|
||||
- Limited personal use is permitted if it doesn't interfere with work
|
||||
- No illegal activities or viewing inappropriate content
|
||||
|
||||
**Monitoring:**
|
||||
|
||||
- Company reserves the right to monitor company systems
|
||||
- Employees should have no expectation of privacy on company devices
|
||||
|
||||
**Security:**
|
||||
|
||||
- Use strong passwords and enable 2FA
|
||||
- Report security incidents immediately
|
||||
- Lock devices when unattended
|
||||
@@ -453,11 +469,13 @@ All employees are expected to:
|
||||
### Social Media Policy
|
||||
|
||||
**Personal Social Media:**
|
||||
|
||||
- Clearly state opinions are your own, not the company's
|
||||
- Do not share confidential company information
|
||||
- Be respectful and professional
|
||||
|
||||
**Company Social Media:**
|
||||
|
||||
- Only authorized personnel may post on behalf of the company
|
||||
- Follow brand guidelines
|
||||
- Escalate negative comments to [Marketing/PR]
|
||||
@@ -476,16 +494,17 @@ understand that:
|
||||
|
||||
I agree to abide by the policies and procedures outlined in this handbook.
|
||||
|
||||
Employee Signature: _________________________
|
||||
Employee Signature: ************\_************
|
||||
|
||||
Employee Name (Print): _________________________
|
||||
Employee Name (Print): ************\_************
|
||||
|
||||
Date: _________________________
|
||||
Date: ************\_************
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
### Do's
|
||||
|
||||
- **Consult legal counsel** - Employment law varies by jurisdiction
|
||||
- **Keep copies signed** - Document all agreements
|
||||
- **Update regularly** - Laws and policies change
|
||||
@@ -493,6 +512,7 @@ Date: _________________________
|
||||
- **Train managers** - On policies and procedures
|
||||
|
||||
### Don'ts
|
||||
|
||||
- **Don't use generic templates** - Customize for your jurisdiction
|
||||
- **Don't make promises** - That could create implied contracts
|
||||
- **Don't discriminate** - In language or application
|
||||
|
||||
@@ -20,12 +20,12 @@ Practical implementation guide for GDPR-compliant data processing, consent manag
|
||||
|
||||
### 1. Personal Data Categories
|
||||
|
||||
| Category | Examples | Protection Level |
|
||||
|----------|----------|------------------|
|
||||
| **Basic** | Name, email, phone | Standard |
|
||||
| **Sensitive (Art. 9)** | Health, religion, ethnicity | Explicit consent |
|
||||
| **Criminal (Art. 10)** | Convictions, offenses | Official authority |
|
||||
| **Children's** | Under 16 data | Parental consent |
|
||||
| Category | Examples | Protection Level |
|
||||
| ---------------------- | --------------------------- | ------------------ |
|
||||
| **Basic** | Name, email, phone | Standard |
|
||||
| **Sensitive (Art. 9)** | Health, religion, ethnicity | Explicit consent |
|
||||
| **Criminal (Art. 10)** | Convictions, offenses | Official authority |
|
||||
| **Children's** | Under 16 data | Parental consent |
|
||||
|
||||
### 2. Legal Bases for Processing
|
||||
|
||||
@@ -58,21 +58,25 @@ Right to Object (Art. 21) ─┘
|
||||
// Consent data model
|
||||
const consentSchema = {
|
||||
userId: String,
|
||||
consents: [{
|
||||
purpose: String, // 'marketing', 'analytics', etc.
|
||||
granted: Boolean,
|
||||
timestamp: Date,
|
||||
source: String, // 'web_form', 'api', etc.
|
||||
version: String, // Privacy policy version
|
||||
ipAddress: String, // For proof
|
||||
userAgent: String // For proof
|
||||
}],
|
||||
auditLog: [{
|
||||
action: String, // 'granted', 'withdrawn', 'updated'
|
||||
purpose: String,
|
||||
timestamp: Date,
|
||||
source: String
|
||||
}]
|
||||
consents: [
|
||||
{
|
||||
purpose: String, // 'marketing', 'analytics', etc.
|
||||
granted: Boolean,
|
||||
timestamp: Date,
|
||||
source: String, // 'web_form', 'api', etc.
|
||||
version: String, // Privacy policy version
|
||||
ipAddress: String, // For proof
|
||||
userAgent: String, // For proof
|
||||
},
|
||||
],
|
||||
auditLog: [
|
||||
{
|
||||
action: String, // 'granted', 'withdrawn', 'updated'
|
||||
purpose: String,
|
||||
timestamp: Date,
|
||||
source: String,
|
||||
},
|
||||
],
|
||||
};
|
||||
|
||||
// Consent service
|
||||
@@ -85,7 +89,7 @@ class ConsentManager {
|
||||
source: metadata.source,
|
||||
version: await this.getCurrentPolicyVersion(),
|
||||
ipAddress: metadata.ipAddress,
|
||||
userAgent: metadata.userAgent
|
||||
userAgent: metadata.userAgent,
|
||||
};
|
||||
|
||||
// Store consent
|
||||
@@ -95,22 +99,22 @@ class ConsentManager {
|
||||
$push: {
|
||||
consents: consent,
|
||||
auditLog: {
|
||||
action: granted ? 'granted' : 'withdrawn',
|
||||
action: granted ? "granted" : "withdrawn",
|
||||
purpose,
|
||||
timestamp: consent.timestamp,
|
||||
source: metadata.source
|
||||
}
|
||||
}
|
||||
source: metadata.source,
|
||||
},
|
||||
},
|
||||
},
|
||||
{ upsert: true }
|
||||
{ upsert: true },
|
||||
);
|
||||
|
||||
// Emit event for downstream systems
|
||||
await this.eventBus.emit('consent.changed', {
|
||||
await this.eventBus.emit("consent.changed", {
|
||||
userId,
|
||||
purpose,
|
||||
granted,
|
||||
timestamp: consent.timestamp
|
||||
timestamp: consent.timestamp,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -119,7 +123,7 @@ class ConsentManager {
|
||||
if (!record) return false;
|
||||
|
||||
const latestConsent = record.consents
|
||||
.filter(c => c.purpose === purpose)
|
||||
.filter((c) => c.purpose === purpose)
|
||||
.sort((a, b) => b.timestamp - a.timestamp)[0];
|
||||
|
||||
return latestConsent?.granted === true;
|
||||
@@ -137,12 +141,14 @@ class ConsentManager {
|
||||
<div class="consent-banner" role="dialog" aria-labelledby="consent-title">
|
||||
<h2 id="consent-title">Cookie Preferences</h2>
|
||||
|
||||
<p>We use cookies to improve your experience. Select your preferences below.</p>
|
||||
<p>
|
||||
We use cookies to improve your experience. Select your preferences below.
|
||||
</p>
|
||||
|
||||
<form id="consent-form">
|
||||
<!-- Necessary - always on, no consent needed -->
|
||||
<div class="consent-category">
|
||||
<input type="checkbox" id="necessary" checked disabled>
|
||||
<input type="checkbox" id="necessary" checked disabled />
|
||||
<label for="necessary">
|
||||
<strong>Necessary</strong>
|
||||
<span>Required for the website to function. Cannot be disabled.</span>
|
||||
@@ -151,7 +157,7 @@ class ConsentManager {
|
||||
|
||||
<!-- Analytics - requires consent -->
|
||||
<div class="consent-category">
|
||||
<input type="checkbox" id="analytics" name="analytics">
|
||||
<input type="checkbox" id="analytics" name="analytics" />
|
||||
<label for="analytics">
|
||||
<strong>Analytics</strong>
|
||||
<span>Help us understand how you use our site.</span>
|
||||
@@ -160,7 +166,7 @@ class ConsentManager {
|
||||
|
||||
<!-- Marketing - requires consent -->
|
||||
<div class="consent-category">
|
||||
<input type="checkbox" id="marketing" name="marketing">
|
||||
<input type="checkbox" id="marketing" name="marketing" />
|
||||
<label for="marketing">
|
||||
<strong>Marketing</strong>
|
||||
<span>Personalized ads based on your interests.</span>
|
||||
@@ -560,16 +566,19 @@ class BreachNotificationHandler:
|
||||
## GDPR Implementation Checklist
|
||||
|
||||
### Legal Basis
|
||||
|
||||
- [ ] Documented legal basis for each processing activity
|
||||
- [ ] Consent mechanisms meet GDPR requirements
|
||||
- [ ] Legitimate interest assessments completed
|
||||
|
||||
### Transparency
|
||||
|
||||
- [ ] Privacy policy is clear and accessible
|
||||
- [ ] Processing purposes clearly stated
|
||||
- [ ] Data retention periods documented
|
||||
|
||||
### Data Subject Rights
|
||||
|
||||
- [ ] Access request process implemented
|
||||
- [ ] Erasure request process implemented
|
||||
- [ ] Portability export available
|
||||
@@ -577,17 +586,20 @@ class BreachNotificationHandler:
|
||||
- [ ] Response within 30-day deadline
|
||||
|
||||
### Security
|
||||
|
||||
- [ ] Encryption at rest implemented
|
||||
- [ ] Encryption in transit (TLS)
|
||||
- [ ] Access controls in place
|
||||
- [ ] Audit logging enabled
|
||||
|
||||
### Breach Response
|
||||
|
||||
- [ ] Breach detection mechanisms
|
||||
- [ ] 72-hour notification process
|
||||
- [ ] Breach documentation system
|
||||
|
||||
### Documentation
|
||||
|
||||
- [ ] Records of processing activities (Art. 30)
|
||||
- [ ] Data protection impact assessments
|
||||
- [ ] Data processing agreements with vendors
|
||||
@@ -596,6 +608,7 @@ class BreachNotificationHandler:
|
||||
## Best Practices
|
||||
|
||||
### Do's
|
||||
|
||||
- **Minimize data collection** - Only collect what's needed
|
||||
- **Document everything** - Processing activities, legal bases
|
||||
- **Encrypt PII** - At rest and in transit
|
||||
@@ -603,6 +616,7 @@ class BreachNotificationHandler:
|
||||
- **Regular audits** - Verify compliance continuously
|
||||
|
||||
### Don'ts
|
||||
|
||||
- **Don't pre-check consent boxes** - Must be opt-in
|
||||
- **Don't bundle consent** - Separate purposes separately
|
||||
- **Don't retain indefinitely** - Define and enforce retention
|
||||
|
||||
Reference in New Issue
Block a user