Dashboard Regulations DirectoryGeneral Data Protection Regulation (GDPR)

EU JurisdictionEnforceable Ruleset12 Active Controls

General Data Protection Regulation (GDPR)

Authentic statutory obligations decomposed into atomic machine-actionable conditions, actions, and verification standards.

Official Legal Text

Highobligation98% AI Match

Storage Limitation

Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (Article 5(1)(e)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "retention_schedule_defined": true
}

Highobligation98% AI Match

Conditions for Valid Consent

Where processing is based on consent, the controller must be able to demonstrate that the data subject has consented, with clear withdrawal mechanisms as easy as giving consent (Article 7).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "opt_in_mandatory": true,
  "no_pre_ticked_boxes": true
}

Highobligation98% AI Match

Data Protection by Design and by Default

The controller shall implement appropriate technical and organisational measures, such as pseudonymisation, designed to implement data-protection principles effectively (Article 25).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "pseudonymization": true,
  "default_private_settings": true
}

Criticalobligation98% AI Match

Lawfulness, Fairness, and Transparency

Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1)(a)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "transparency_notice": true,
  "legal_basis_required": true
}

Highobligation98% AI Match

Purpose Limitation

Personal data must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (Article 5(1)(b)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "compatible_use_only": true,
  "purpose_specification": true
}

Highobligation98% AI Match

Data Protection Impact Assessment (DPIA)

Where processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall carry out an assessment of the impact (Article 35).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "high_risk_processing_identified": true
}

Mediumobligation98% AI Match

Accuracy and Prompt Rectification

Personal data must be accurate and, where necessary, kept up to date; reasonable steps must be taken to ensure inaccurate data are erased or rectified without delay (Article 5(1)(d)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "user_rectification_channel": true
}

Criticalobligation98% AI Match

Controller Accountability

The controller shall be responsible for, and be able to demonstrate compliance with, the principles relating to processing of personal data (Article 5(2)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "compliance_records_maintained": true
}

Criticalobligation98% AI Match

Notification of Personal Data Breach to Supervisory Authority

In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the competent supervisory authority (Article 33).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "72h_authority_alert": true,
  "incident_detection_sla": true
}

Criticalobligation98% AI Match

Right to Erasure ('Right to be Forgotten')

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay (Article 17).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "30_day_sla": true,
  "erasure_api_operational": true
}

Highobligation98% AI Match

Data Minimisation

Personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (Article 5(1)(c)).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "excessive_data_prevention": true
}

Criticalobligation98% AI Match

Integrity and Confidentiality (Security of Processing)

Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss (Article 5(1)(f) & Article 32).

Required Actions & Enforcement

Statutory verification and compliance logging required.

Trigger Conditions (AST Logic)

{
  "rbac_enforced": true,
  "tls_in_transit": true,
  "encryption_at_rest": true
}