Appendix B — Obligation–control–owner–system–test–evidence master matrix

This is a populated author-designed crosswalk for all existing OBL operational aliases, not a statutory form, exhaustive entity compliance register or claim that every duty has been tested. Appendix A retains the complete primary provision register, including distinct actors, conditions and commencement. The JSON below carries those source fields unchanged and links a recommended owned interface and proposed negative test.

Open the editable JSON or CSV. Exact source passages were checked against physical newline ranges during generation. A hash or complete row count does not validate a real enterprise interpretation.

B.1 How to use the crosswalk

Start with applicability in the linked legal record. Decide whether the duty belongs to the Company, a Consent Manager, a Data Principal or a public institution. Do not assign an institutional function to the Company simply because it appears in the source register. For each applicable activity, replace the hypothetical owner and system with verified facts, specify a deployment test and attach its actual result. The proposed test ID is an editorial specification, not an identifier of an executed test.

The local execution reference points to the bounded dossier runner. Read the named checks and input hashes before claiming any coverage. A successful stale-replay example does not discharge a complete safeguards duty; a missing supplier acknowledgement remains missing. Definitions and institutional rows may require source/authority review rather than an invented software test.

B.2 Populated ownership and evidence map

B.3 What must not be flattened

Control OBL-05 contains distinct consent actors and tranches; consult its canonical subrows instead of assigning one deadline to the whole label. SDF rows remain conditional; the base Company is not designated. Rights rows do not imply that every component has identical scope or a universal response SLA. Transfer rows preserve the specific source and sector conditions. The crosswalk retains the full source conditions in JSON rather than replacing them with this compact reader table.

The system column identifies the recommended decision/evidence surface, not proof that an endpoint exists. SPEC-Q10 identifiers are new review prompts and do not rename the fixed CASE-001 identities. If a test cannot be run, preserve proposed/unverified status and a release condition rather than writing “pass”. Blank production evidence is an explicit gap; a populated synthetic example is a different kind of object, not a way to fill that gap.

Contents · Appendix A · Appendix C