---
id: 08-docs-compliance-reference-files
epic: compliance-manifests-pii-retention-subprocessors
title: docs/compliance reference example files and README
type: technical-story
status: done
feature: docs
depends-on: [06-compliance-generator-scripts]
blocks: []
created: 2026-05-18T17:52:09Z
updated: 2026-05-18T20:23:30.582Z
---

## Goal

Add `docs/compliance/data-map.example.yml`, `docs/compliance/retention-policy.example.yml`, `docs/compliance/sub-processors.example.yml`, and `docs/compliance/README.md` explaining the `docs/compliance/` (templates / examples) vs root `compliance/` (live generated artifacts) split and how to operate the generators.

## Why

Without documentation, a downstream consumer editing `compliance/*.yml` manually won't understand which files are generated vs hand-authored, what fields each entry requires, or how to run the generators. The `docs/compliance/` folder becomes the canonical onboarding reference for the compliance module.

## Done when

- `docs/compliance/data-map.example.yml` shows a complete data-map entry with every field (`category`, `purpose`, `exportable`, `restrictable`, optional `retention`) populated and annotated.
- `docs/compliance/retention-policy.example.yml` shows a complete retention-policy entry (`activeRetention`, `postDeletion`, `purgeSchedule`, optional `coldArchive`).
- `docs/compliance/sub-processors.example.yml` shows both a trace-backed entry (`is-sub-processor: true` with all conditional fields) and a `source: manual` hand-authored entry.
- `docs/compliance/README.md` explains: what each YAML file contains, how they are generated, the `docs/compliance/` (examples) vs `compliance/` (live) split, when and how to author `compliance/sub-processors.manual.yml`, and how to run `pnpm compliance:emit-all`.
- `pnpm typecheck && pnpm lint && pnpm test && pnpm conformance && pnpm fallow:audit && pnpm coverage:diff` all pass.

## In scope

- `docs/compliance/data-map.example.yml`
- `docs/compliance/retention-policy.example.yml`
- `docs/compliance/sub-processors.example.yml`
- `docs/compliance/README.md`

## Out of scope

- `compliance/sub-processors.manual.yml` — consumer-authored artifact; not shipped by the template.
- Runbooks, privacy policies, pre-launch checklist — Epic D territory.

## Tasks

- [x] Add `docs/compliance/data-map.example.yml`, `docs/compliance/retention-policy.example.yml`, `docs/compliance/sub-processors.example.yml`, and `docs/compliance/README.md` explaining the docs/compliance (templates) vs compliance/ (live artifacts) split, generator usage, and manual sub-processor entry authoring — all gates pass on this commit.
