Legal pillar · v0.8.1
policy Policy
Organizational policy document.
$id · https://corpospec.com/schemas/v0.8.1/policy.schema.json
Fields
| Field | Type | Required | Description |
|---|---|---|---|
| description | string | yes | One-paragraph summary of the policy's purpose and the obligations it imposes. |
| id | PathRef | yes | Path-based cross-reference relative to .corpospec/ root. Pattern: `^[a-z0-9_-]+(/[a-z0-9_.-]+)+$` |
| name | string | yes | Short human-readable title (e.g. "Data Retention Policy"). |
| owner | PathRef | yes | PathRef into `people/**` for the person accountable for this policy — reviewing, updating, and enforcing it. |
| scope | string | yes | Population and data the policy applies to. Prose description of the in-scope population (e.g. "All full-time employees"), systems, or data categories. Common categories include company-wide, engineering, customer-data, employee-data, and third-party-processors. |
| status | PolicyStatus | yes | Policy lifecycle status. |
| custom | PolicyCustom? | — | |
| effective_date | IsoDate? | — | |
| provisions | string[] | — | |
| related_decisions | PathRef[] | — | |
| review_date | IsoDate? | — |
Definitions
Shared types referenced within this schema.
DataProcessor
A data processor entry in a data protection policy.
Represents a sub-processor under Art. 28 GDPR. Name and service identify the
vendor; `dpa_status` tracks the Auftragsverarbeitungsvertrag (DPA) lifecycle.
type: object
DpaStatus
Data processing agreement (DPA) execution status for a processor under Art. 28 GDPR.
IsoDate
ISO 8601 date (YYYY-MM-DD).
type: string
PathRef
Path-based cross-reference relative to .corpospec/ root.
Pattern: `^[a-z0-9_-]+(/[a-z0-9_.-]+)+$`
pattern: ^[a-z0-9_-]+(/[a-z0-9_.-]+)+$
PolicyCustom
Typed custom extension data for `Policy`.
type: object
PolicyStatus
Policy lifecycle status.
enum: "draft", "active", "under-review", "archived"
Reference in your YAML
# yaml-language-server: $schema=https://corpospec.com/schemas/v0.8.1/policy.schema.json