# GDPR readiness — internal release checklist

**Product:** International Press Zone
**Status:** INTERNAL DRAFT — NOT A CLAIM OF GDPR COMPLIANCE
**Technical alignment review:** 2026-08-19

The previous document made categorical compliance claims and listed historical payment/activation-credential data flows. This replacement is an engineering/legal readiness checklist. It must not be published as proof that Press.Zone or International Press Zone is compliant with the GDPR.

## 1. Production data map

Before commercial go-live, document every production processing activity used by the release:

- Press.Zone account/social-auth data;
- WordPress site identity and connection metadata;
- backend-issued per-site credential lifecycle;
- translation content submitted to the Press.Zone service;
- translation/job metadata and usage/metering;
- support and operational logs;
- billing/subscription metadata after the production payment processor is cleared;
- cookies/session identifiers on hosted account/connect surfaces;
- backup/retention copies and deletion paths.

For each activity record data categories, purpose, system of record, retention, recipients/subprocessors, transfer location, access controls, and deletion mechanism.

## 2. Roles and lawful basis

Qualified privacy/legal review must determine, for each processing activity:

- whether Press.Zone acts as controller, processor, or joint controller;
- the applicable lawful basis;
- whether a data-processing agreement is required with the customer;
- whether customer instructions/configuration are required;
- whether special-category or children's data needs additional restrictions.

Do not infer these roles from repository architecture alone.

## 3. Data minimization and access

Engineering review must verify:

- the plugin sends only fields required by supported features;
- customer-facing JavaScript does not expose the backend-issued site credential;
- secrets are excluded from logs, release artifacts, diagnostics, and support bundles;
- site/job authorization prevents cross-customer access;
- staff/admin access to production data is role-controlled and auditable;
- debug/support tooling avoids unnecessary customer content capture.

## 4. Translation content

AI translation requires selected customer content to be transmitted to the Press.Zone translation service. The production privacy/DPA documents must state this accurately and identify any model/API provider or subprocessor that receives that content, together with the applicable retention/training settings actually configured in production.

## 5. Payments

Stripe production clearance is pending. After clearance:

- document the exact Stripe data flow;
- identify which payment data Press.Zone receives versus data handled only by Stripe;
- verify the processor agreement and international-transfer position as applicable;
- align privacy, terms, refund policy, account UI, and backend retention behavior.

Do not retain historical payment-provider entries that are not part of the production release.

## 6. Data-subject rights and deletion

Legal/product owners must define and engineering must verify operational procedures for applicable rights requests, including access, correction, deletion, restriction, portability, and objection where required. Each procedure needs an actual data lookup/deletion path across account, site, translation metadata, logs, billing records, and backups subject to lawful retention obligations.

## 7. Security and incident response

Document only controls actually deployed. At minimum verify:

- credential/secret handling and rotation;
- transport security at production endpoints;
- authentication/authorization boundaries;
- vulnerability/dependency process;
- backup/restore behavior where applicable;
- audit/security logging without secret leakage;
- incident escalation and breach-assessment ownership.

Do not promise continuous monitoring, fixed breach-response times, certifications, or named security programs without current operational evidence.

## 8. Subprocessors and transfers

Create the subprocessor list from the production stack, not from historical drafts. Record service, purpose, data categories, region, contractual mechanism, and owner for keeping the list current.

## 9. Release approval

- [ ] Production data map complete.
- [ ] Translation/model-provider processing documented.
- [ ] Stripe data flow documented after clearance.
- [ ] Subprocessor list verified.
- [ ] Retention/deletion behavior verified.
- [ ] DPA/controller-processor roles reviewed.
- [ ] Rights-request procedures operational.
- [ ] Security/incident statements match deployed controls.
- [ ] Qualified privacy/legal reviewer signs off on customer-facing privacy/DPA materials.
- [ ] Final documents/version/date linked from the release receipt.