compliancelisted

# Compliance Patterns Regulatory compliance review for code that touches regulated data. Use alongside `devflow:security` for complete coverage. ## Iron Law > **IF IT TOUCHES REGULATED DATA: CLASSIFY IT, MINIMIZE IT, ENCRYPT IT, AUDIT IT** > > Regulated data crossing a code path without classification, minimization, encryption, > or an audit trail is a compliance gap — regardless of framework. No exceptions. ## Project Framework Declaration Read the project CLAUDE.md `## Compliance` section before reviewing: - `Frameworks: GDPR, SOC 2` → apply generic controls + load `references/{framework}.md` (case-insensitive) - `Frameworks: none` → all compliance integrations disabled for this project; skip review - Absent → generic controls only; suggest declaring (LOW, at most once) when regulated data is clearly present - Unknown framework name → generic controls + explicit coverage-gap note; never fabricate framework specifics ## Scope Boundary Compliance covers regulatory-specific gaps: retention, erasure/data-subject rights, audit-trail completeness (actor/purpose fields), segregation of duties, framework mapping, IaC exposure. Do NOT re-raise security lens findings (injection, secret handling, authN/Z) — reference those via framework mapping only. ## Clean-Report Contract If the diff/design has no regulated-data surface (no PII/PHI/payment fields, no sensitive data in logs, no IaC, no auth/audit/retention changes) → emit zero findings with a one-line "no compliance-relevan