fides | Privacy as Code for your CI and runtime environment | Privacy library

Get running with Docker: First, ensure that you have make and docker installed locally, and clone the Fides repo. Then, from the fides directory, run the following commands:.
Get running with Docker: First, ensure that you have make and docker installed locally, and clone the Fides repo. Then, from the fides directory, run the following commands: This will spin up the entire project and open a shell within the fidesctl container. Once you see the fidesctl# prompt (takes ~3 minutes the first time), you know you're ready to go: Run make cli ~/git/fides% make cli Build the images required in the docker-compose file... ... Building fidesapi ... Building fidesctl ... Building docs ... root@1a742083cedf:/fides/fidesctl# This builds the required images, spins up the database, and runs the initialization scripts. Run fidesctl db init ~/git/fides% fidesctl db init INFO [alembic.runtime.migration] Context impl PostgresqlImpl. INFO [alembic.runtime.migration] Will assume transactional DDL. This confirms that your fidesctl CLI can reach the server and everything is ready to go! Run fidesctl ping root@796cfde906f1:/fides/fidesctl# fidesctl ping Pinging http://fidesctl:8080/health... { "data": { "message": "Fides service is healthy!" } }
Run fidesctl evaluate demo_resources/. This command ensures that the demo_analytics_system and demo_marketing_system systems are compliant with your privacy policy as code: Results of fidesctl evaluate root@fa175a43c077:/fides/fidesctl# fidesctl evaluate demo_resources Loading resource manifests from: demo_resources Taxonomy successfully created. ---------- Processing registry resources... CREATED 1 registry resources. UPDATED 0 registry resources. SKIPPED 0 registry resources. ---------- Processing dataset resources... CREATED 1 dataset resources. UPDATED 0 dataset resources. SKIPPED 0 dataset resources. ---------- Processing policy resources... CREATED 1 policy resources. UPDATED 0 policy resources. SKIPPED 0 policy resources. ---------- Processing system resources... CREATED 2 system resources. UPDATED 0 system resources. SKIPPED 0 system resources. ---------- Loading resource manifests from: demo_resources Taxonomy successfully created. Evaluating the following policies: demo_privacy_policy ---------- Checking for missing resources... Executing evaluations... Sending the evaluation results to the server... Evaluation passed! Congratulations, you've successfully run your first fidesctl evaluate command!
Now, take a closer look at demo_resources/demo_policy.yml which describes an organization's privacy policy as code. This policy just includes one rule: fail if any system uses contact information for marketing purposes. Run cat demo_resources/demo_policy.yml policy: - fides_key: demo_privacy_policy name: Demo Privacy Policy description: The main privacy policy for the organization. rules: - fides_key: reject_direct_marketing name: Reject Direct Marketing description: Disallow collecting any user contact info to use for marketing. data_categories: matches: ANY values: - user.provided.identifiable.contact data_uses: matches: ANY values: - advertising data_subjects: matches: ANY values: - customer data_qualifier: aggregated.anonymized.unlinked_pseudonymized.pseudonymized.identified
Lastly, we're going to modify our annotations in a way that would fail the policy we just looked at: Edit demo_resources/demo_system.yml and uncomment the line that adds user.provided.identifiable.contact to the list of data_categories for the demo_marketing_system. Add User-provided contact info to the demo_marketing_system privacy_declarations: - name: Collect data for marketing data_categories: - #- user.provided.identifiable.contact # uncomment to add this category to the system + - user.provided.identifiable.contact # uncomment to add this category to the system - user.derived.identifiable.device.cookie_id data_uses: marketing_advertising_or_promotion data_subjects: Run fidesctl evaluate again Re-run `fidesctl evaluate demo_resources` which will cause an evaluation failure! This is because your privacy policy has 1 rule that should fail if any system uses contact information for marketing purposes, and you've just updated your marketing system to start using contact information for marketing purposes. root@fa175a43c077:/fides/fidesctl# fidesctl evaluate demo_resources ... Executing evaluations... { "status": "FAIL", "details": [ "Declaration (Collect data for marketing) of System (demo_marketing_system) failed Rule (Reject Direct Marketing) from Policy (demo_privacy_policy)" ], "message": null }