# Lab guiado: auditar un formulario real sin PII

**Curso:** Gobernanza y Compliance Digital · **Duración estimada:** 3–4 h · **Nivel:** universitario

## Objetivo

Take a registration form, remove every unnecessary personal datum, and justify each one.

## Marco legal y ético

It works with public forms or your own: never with other people's real data.

## Pasos

1. Choose a real form (registration for a course, gym, library).
2. Field inventory: name, surname, email, phone, birthdate, ID, address, notes.
3. For each field answer the 5 RGPD questions from the cheatsheet.
4. Cross out: everything without purpose or lawful basis.
5. Redesign: which fields remain? What replaces what was removed? (e.g.: token instead of email).
6. Write the treatment register of the new form (what/why/how long/where/who).
7. Compare: what the service loses vs what it stops to leak.

## Evidencia a entregar

Table field × decision × justification + new form register in `evidencia-compliance.md`.

## Criterio de superación

La evidencia debe permitir que otra persona **reproduzca** el resultado sin preguntarte
nada. Si no es reproducible, no es evidencia (ver [rúbrica](rubrica.md)).