# GitHub Copilot Instructions

## project

Ensure code meets ACME compliance requirements.
We are SOC 2 Type II and GDPR compliant.

## code-standards

### soc2

- Logging required with 1 year retention
- Tamper-proof audit logs
- Access control documented and reviewed quarterly
- Change management: documented, approved, tested

### gdpr

- Apply data minimization
- Enforce purpose limitation
- Consent management required
- Support right to erasure
- Enable data portability
- Breach notification within 72 hours

### pci

- Applies to payment services only
- Never store full PAN
- Encryption required

## donts

- Don't process data beyond stated purpose
- Don't retain data longer than necessary
- Always document data processing activities
- Always provide data subject rights mechanisms
- Don't transfer data to non-approved regions

## Compliance Resources

- Compliance Portal: https://compliance.acme.com
- Data Classification: https://wiki.acme.com/data-classification
- Privacy Policy: https://acme.com/privacy

## Data Classification

- **Public**: Marketing materials, public docs
- **Internal**: Internal communications, non-sensitive
- **Confidential**: Business data, customer info
- **Restricted**: PII, financial data, credentials

## Regional Requirements

- EU: GDPR compliance required
- California: CCPA compliance required
- Healthcare: HIPAA where applicable
