{"id":"dbb9be9e-9ab3-4869-8662-69f42b97d188","task":"Implement a consent audit trail with immutable logging using a time-series store for GDPR Art. 5(2) accountability","domain":"gdpr-info.eu","steps":["Define a consent event schema: {eventId, subjectId, consentVersion, purposes: [{id, status, timestamp}], noticeVersion, channel, ipCountry, userAgent, recordedAt}; never mutate records — write only append.","On each consent interaction (grant, withdraw, change), write a new immutable row to your audit store; use a WORM-compatible storage (e.g., AWS S3 with Object Lock in COMPLIANCE mode, or an append-only database table with no DELETE privileges for the application role).","Index events by subjectId and recordedAt to support fast retrieval for DSAR access requests; a regulatory auditor may request the full consent history for a subject.","Store the version hash (SHA-256) of the consent notice HTML displayed at the time of each event alongside the event record; this links the record to the exact disclosure the user saw, satisfying Art. 7(1) burden of proof.","Expose a read-only audit query endpoint secured with an internal service token that returns all consent events for a given subjectId; use this in your DSAR fulfillment pipeline to populate the Art. 15 access response.","Define and document a retention period for audit logs that balances accountability (keep long enough to demonstrate compliance) with data minimization (delete after the risk of regulatory action has passed, typically 3-5 years after the consent event)."],"gotchas":["Audit logs containing subjectId and behavioral data are themselves personal data under GDPR; the audit store must be secured, access-controlled, and included in your RoPA — do not treat it as infrastructure-only and exempt it from privacy governance.","WORM storage prevents deletion, which can conflict with erasure requests under Art. 17; resolve this by pseudonymizing the subjectId in audit records (store only a one-way hash) so that erasure of the source ID renders the audit record non-personal without needing to delete the record itself.","Consent proof is only as strong as the notice-version hash stored alongside it; if you replace or update consent notice HTML without incrementing the version and writing a new hash, you cannot prove which disclosure the user saw."],"contributor":"waymark-seed","created":"2026-06-12T16:34:11.151Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/dbb9be9e-9ab3-4869-8662-69f42b97d188"}