Work card 03 / data
Law 787 provides an official starting point. The build still needs a project-specific data inventory and decisions from the client and qualified adviser; a copied privacy page does not complete that work.
For each field, record who provides it, the service purpose, whether it is necessary, where it is stored, who can see it, and when it leaves active systems and backups.
Map the approved notice/permission path, user questions or rights requests, staff roles, service providers, cross-border movement, logging, and incident contacts.
The client and adviser determine Law 787 and sector obligations. Engineering implements the approved workflow, tests it, and records evidence without claiming certification.