Optional Lab 15: Governance applicability and stewardship case¶
Completion: Passing automated checks, where present, confirms technical behavior. Complete the independent task, explanation and evidence specified on this page.
Connection: SLOs 1, 2, 5 and 6; Modules 1, 6–7. Time: 60–90 minutes. This reading and reasoning activity needs no installation or external account. It extends the required short discussion in the module map; it does not replace it.
Why this lab matters¶
A policy recommendation depends on scope, purpose and missing facts. You will practice making a conditional decision with traceable sources rather than claiming compliance from a diagram.
Learning objectives¶
These instructor-developed objectives support the outcomes above. You will:
- Apply source-based scope questions to a fictional scenario.
- Map a proposed control to an owner and evidence need.
- Revise a governance decision when the requested data purpose changes.
Skills you will practice¶
Read primary-source sections, separate facts from assumptions, and write an accountable decision memo.
Part A: Read the scenario and scope questions¶
RetailBridge is a fictional US retailer proposing support-priority predictions. It stores order identifiers, contact details and free-text support messages for customers in several countries. A proposed EU-facing shop would deliberately market to customers in the EU. The launch has not occurred. Some messages voluntarily mention medical conditions. The retailer does not operate a health plan or clinic; no relationship with a covered healthcare organization has been established.
A vendor proposes receiving full support messages for model improvement. The purpose, retention period, location of processing, subcontractors and deletion behavior have not been agreed. The operations manager wants to retain records indefinitely in case they become useful. The team has aggregate accuracy results but no subgroup evaluation. These are scenario facts and gaps, not a real organization's compliance assessment.
Read primary sources¶
- European Commission: GDPR application.
- GDPR official text: read Articles 3 (scope), 5 (principles), 6 (lawfulness), and 28 (processors); identify other relevant provisions only when justified by your scenario analysis.
- HHS: covered entities and business associates.
- NIST AI RMF for voluntary governance guidance; distinguish it from legislation.
Record access dates and exact sections. Source links were checked on 2026-09-25; recheck current applicability when adapting the exercise. Do not equate health-related text with automatic HIPAA coverage, or assume a US headquarters excludes GDPR. The sources establish scope tests, not the final answer for every hypothetical fact.
Guided example¶
Claim: "Indefinite retention is justified because the data may be useful." Question to investigate: which specified purpose requires which records, for how long? Possible proposed control: a purpose-specific retention schedule with owner approval. Missing evidence: approved periods, deletion tests, holds and downstream-copy handling. This example illustrates a reasoning pattern; it is not a legal retention period.
Supported analysis¶
Copy this matrix into your private submission or word processor. Add two rows: one potential GDPR issue and one HIPAA applicability question. Replace every Fill in prompt. No terminal command or database change is required:
| Fact or missing fact | Source and section | Applicability reasoning / uncertainty | Proposed control | Accountable role | Evidence needed | Status |
|---|---|---|---|---|---|---|
| Fill in | Fill in | Fill in | Fill in | Fictional role | Test, document or decision | Proposed / demonstrated / untested |
Clearly distinguish a legal requirement, a contractual condition, voluntary guidance and an internal policy choice. Ask what fact would change each conclusion.
Part B: Make and revise a stewardship decision¶
The vendor now requests permission to use the same messages to screen refund requests. Write a one-page approve/conditionally approve/defer/reject memo addressing purpose, minimum necessary fields, vendor responsibilities, affected people, retention, transparency, human review and appeal. Include an exception register entry with request, rationale, approver role, expiry/review trigger and unresolved risk. Do not invent facts to justify approval; requesting more information is valid.
Assessment and submission¶
Submit the matrix, memo and source list privately. No completion screenshot is needed. Rubric: scope and source reasoning 30%; control/evidence mapping 30%; accountable lifecycle decision 25%; clarity and uncertainty 15%. Strong work separates established facts from assumptions and identifies how to validate a proposed control. This educational case does not certify regulatory compliance or substitute for legal review.
Author: Isaac K. Nti.