GDPR Interactive Compliance Explorer & Knowledge Graph

Total Normative Clauses

936

Line-by-line Hohfeldian tuples

Binding Legal Obligations

489

Mandatory compliance duties

Knowledge Graph Entities

355

Across 924 relational links

Cryptographic Integrity

100%

EUR-Lex ELI permalink verified

🔍

Quick Toggles:

⏱ Has Deadlines

⚠️ Has Statutory Exceptions

🔗 Has Cross-Citations

936 rules matched

ID	Location	Norm Addressee	Modality	Predicate & Theme	Verbatim Statutory Clause	Provenance

Showing 1-25 of 936 rules

Page 1

⚒

W3C SHACL Executable Policy Audit Engine

Formally validate operational enterprise architecture payloads against machine-readable W3C SHACL constraint shapes grounded in statutory GDPR norms with 4-tier SHA-256 legal provenance.

W3C SHACL 1.0 🔒 100% Provenance Anchored < 1ms Execution

Standard B2B SaaS platform hosted in Frankfurt (EU-central-1), processing customer data with explicit contracts and encryption.

100

Statutory Compliance Status

COMPLIANT

Evaluated

Critical

Standard

Violation Findings & Normative Citations

💰

Statutory Fine Risk & Financial Liability Quantifier

Quantify financial exposure under the formal 5-step methodology established by the European Data Protection Board (EDPB Guidelines 04/2022) pursuant to Article 83 GDPR.

Tier 1: Up to €10M / 2% Tier 2: Up to €20M / 4% EDPB 04/2022 Validated

Worldwide Annual Turnover (€ EUR) Medium Undertaking

Evaluated Infringed Articles (Linked from SHACL Audit)

Infringement Seriousness Rating (Step 1)

Aggravating Modifiers (+%)

Intentional Action (+25%) Recidivism / Past Fines (+20%) Failure to Mitigate (+15%) Obstruction of DPA (+20%)

Mitigating Modifiers (-%)

Spontaneous Notification (-20%) Exemplary Cooperation (-15%) Robust TOMs / ISO 27001 (-15%) Direct Redress to Subjects (-15%)

Estimated Fine Exposure (Expected Amount)

TIER_2 (Art. 83(5))

€2,000,000

Min Exposure

€400,000

Upper Exposure

€2,000,000

Statutory Ceiling

€20,000,000

EDPB Guidelines 04/2022: 5-Step Assessment Trail

Statutory Assessment Wizards

Interactive decision paths for DPIA mandates, 72-hour breach response, and DPO appointment obligations.

DPIA Mandatory Trigger Evaluator

Article 35(3) GDPR • Data Protection Impact Assessment

Art. 35

Automated Profiling: Systematic evaluation producing legal effects (Art. 35(3)(a)).

Large-Scale Sensitive Data: Processing special categories (Art. 9/10) (Art. 35(3)(b)).

Public Surveillance: Systematic monitoring of public area on a large scale (Art. 35(3)(c)).

Vulnerable Data Subjects: Processing data of children or employees (EDPB Criteria).

✓

DPIA Not Mandatory Under Statutory Triggers

Standard processing principles apply under Article 5 and Article 32.

72-Hour Breach Escalation Wizard

Articles 33 & 34 GDPR • Notification & Communication

Art. 33 • 34

Risk to Rights & Freedoms of Individuals:

Were State-of-the-Art Technical Protections Applied (e.g. Encryption)?

⚠

TIER 2: NOTIFY DPA WITHIN 72 HOURS (Art. 33(1))

Notify competent Supervisory Authority without undue delay and within 72 hours.

DPO Mandatory Evaluator

Article 37 GDPR • Data Protection Officer Designation

Art. 37

Public Authority: Processing carried out by a public authority or body (Art. 37(1)(a)).

Regular & Systematic Monitoring: Core activities require regular monitoring on a large scale (Art. 37(1)(b)).

Large Scale Sensitive Data: Core activities consist of processing special data or criminal records (Art. 37(1)(c)).

✓

Mandatory DPO Designation Not Triggered

Statutory criteria under Art. 37(1) not met. Voluntary appointment remains open.

International Open Standards Interoperability

Formal mapping of canonical GDPR legal concepts to the W3C Data Privacy Vocabulary (DPV v1.0), ISO/IEC 27701:2019 (PIMS), and ISO/IEC 27001 (ISMS) Annex A controls.

GDPR Legal Concept	Canonical ID	Legal Basis	W3C DPV Term & IRI	ISO/IEC 27701 Clause	ISO/IEC 27001 Mapping

Subject Taxonomy: Legal Duty-Bearers & Right-Holders

Formal domain definitions of all legal persons, natural persons, and public authorities recognized by the GDPR with Hohfeldian legal roles and statutory capacities.

📝

Article 30 GDPR: Record of Processing Activities (ROPA)

Formal inventory of personal data processing operations required of controllers under Article 30(1) GDPR, structured in compliance with standard European Data Protection Board (EDPB) accountability guidelines.

🔍

4 activities registered

ROPA ID	Activity Name & Purpose	Lawful Basis	Data Subjects	Personal Data	Transfers	Action

🏗

Visual Privacy Architecture Modeler & Live SHACL Auditor

Visually design enterprise data flows, processing nodes, storage regions, and third-party processors. The engine live-evaluates W3C SHACL constraint shapes in < 1ms and computes statutory fine exposure on the fly.

Multi-tenant B2B platform hosted in Frankfurt (EU), governed by binding DPAs and encrypted databases.

100

Live Architecture Health

COMPLIANT ARCHITECTURE

Interactive Architecture Topology Canvas

Data Subject Controller Storage Processor Cross-Border High-Risk AI

Active Architecture Policy Violations (W3C SHACL Grounded)

⚖ Cross-Regulatory Harmonization Engine

Unified statutory conformance across GDPR (2016/679), EU AI Act (2024/1689), and NIS2 Directive (2022/2555).

GDPR: 32016R0679 AI Act: 32024R1689 NIS2: 32022L2555

Statutory Incident Escalation

Dual-Incident SLA Notification Timeline (NIS2 24h • GDPR 72h)

Detection Timestamp: Dual reporting required when cybersecurity incidents compromise personal data confidentiality.

Unified Legal Framework Matrix

Tri-Regulatory Rule Standards Catalog

🛡 Privacy-as-Code DevSecOps Static Analysis Linter

Automated static analysis for Terraform Infrastructure and OpenAPI Specs enforcing GDPR, AI Act, and NIS2 compliance before deployment.

✓ SARIF v2.1.0 Compatible CI/CD & Pre-Commit Gating

Load Architecture / API Spec:

Input Specification (JSON / Terraform Plan / OpenAPI)

Infringements: 0

📋 Article 35 Data Protection Impact Assessment (DPIA) Wizard

Automated statutory risk assessment adhering strictly to EDPB Guidelines WP 248 rev.01 with inherent/residual risk scoring.

GDPR Art. 35 • WP 248

Load Operation Blueprint:

Operation Title

Processing Description & Scope

Triggered High-Risk Criteria

0 / 10

≥2 triggers mandatory DPIA

Inherent Baseline Risk

16 / 25

Likelihood × Severity

Safeguards Reduction

-65%

Applied TOMs mitigating effect

Final Residual Risk

5.6 / 25

🟢 Low Risk

EDPB WP 248 High-Risk Criteria Checklist

Inherent Risk Parameters (Pre-Mitigation)

Likelihood of Harm: Level 4 / 5

Severity of Impact: Level 4 / 5

Technical & Organizational Safeguards (TOMs)

📬 Data Subject Access Request (DSAR) SLA Workflow Orchestrator

Statutory 1-month SLA deadline tracking under Article 12(3) GDPR with Article 17(3) statutory legal exemption evaluation.

Active DSAR Requests

In queue for fulfillment

Urgent Requests (≤5 Days)

Approaching 1-month SLA limit

Statutory Breaches (>30 Days)

Infringing Article 12(3) GDPR

🔍

💬 Verifiable GDPR Legal Assistant

Deterministic, offline Retrieval-Augmented Generation • 100% Cryptographically Grounded • Zero Hallucinations

✓ 100% SHA-256 Verifiable Offline Engine

Suggested:

What must a controller do when a personal data breach occurs?

When is a DPIA mandatory?

Exceptions to right to erasure

6 lawful bases under Art. 6

Fines & penalties under Art. 83

🛡 GDPR Legal Reasoner (Zero-Hallucination Engine)

Welcome to the Verifiable GDPR AI Legal Assistant.

Unlike generic large language models that may fabricate article numbers or misquote statutory timelines, this reasoning engine is mathematically anchored to the 936 line-by-line normative triples of Regulation (EU) 2016/679.

Ask any legal or compliance question, or select a suggested prompt above. Every retrieved legal rule includes its exact Hohfeldian modality, duty bearer, statutory timeline, and cryptographic SHA-256 provenance link.

GDPR Compliance Explorer