[COMMUNITY] Generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — legal basis mapping, data subject rights, transfers, DPIA screening, and breach notification across all member states
[COMMUNITY] Generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — legal basis mapping, data subject rights, transfers, DPIA screening, and breach notification across all member states
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate a GDPR Compliance Assessment (EU 2016/679) for any organisation processing personal data of EU/EEA residents. This command takes a member-state-neutral approach to the EU GDPR baseline. For French-specific CNIL obligations, run $arckit-fr-rgpd after this assessment.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
DATA (Data Model) — Extract: all entities with personal data, special category data (Article 9), data subjects, data flows to third parties, retention periods, data classifications
If missing: warn that GDPR assessment requires a data model to identify what personal data is processed and how
RECOMMENDED (read if available, note if missing):
REQ (Requirements) — Extract: data requirements (DR-xxx), compliance requirements (NFR-C-xxx), security requirements (NFR-SEC-xxx), integration points that involve personal data transfer
STKE (Stakeholder Analysis) — Extract: data subject categories, vulnerable groups, organisation's role (controller / processor), RACI for data governance
PRIN (Architecture Principles, 000-global) — Extract: privacy by design principles, data minimisation, retention policies
SECD (Secure by Design) — Extract: security controls relevant to Article 32 assessment
Step 0b: Read external documents and policies
Read any in — extract existing privacy policies, Records of Processing Activities (RoPA), Data Processing Agreements, previous DPIA reports, transfer impact assessments
external documents
external/
Read any global policies in 000-global/policies/ — extract organisational privacy policy, data retention schedule, data classification scheme, DPO mandate
Citation traceability: When referencing content from external documents, follow .arckit/references/citation-instructions.md.
Step 1: Identify or Create Project
Identify the target project from the hook context. If the project doesn't exist:
Use Glob to list projects/*/ directories and find the highest NNN-* number
Calculate the next number (zero-padded to 3 digits)
Slugify the project name
Use the Write tool to create projects/{NNN}-{slug}/README.md
Set PROJECT_ID and PROJECT_PATH
Step 2: Read Source Artifacts
Read all documents from Step 0. Identify:
Role: controller / processor / joint controller (from stakeholder analysis or user input)
Special category data presence (Article 9) → stricter requirements
International transfers → Schrems II / TIA requirements
Data subjects: consumers, employees, patients, children?
Lead supervisory authority: determined by the controller's main establishment
Step 3: GDPR Template Reading
Read the template (with user override support):
First, check if .arckit/templates-custom/eu-rgpd-template.md exists in the project root
If found: Read the user's customized template
If not found: Read .arckit/templates/eu-rgpd-template.md
Step 4: DPIA Screening (Article 35 — Automated)
Based on the data model and requirements, automatically score the EDPB 9 criteria:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ GDPR Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
🔒 Classification: OFFICIAL-SENSITIVE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Assessment Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Role: {Controller / Processor / Joint Controller}
Lead DPA: {Authority name}
Data Subjects: {Categories}
Special Category Data: {Yes (categories) / No}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 DPIA Screening: {N}/9 criteria → {REQUIRED / RECOMMENDED / NOT REQUIRED}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
International Transfers: {N} transfers identified
{List destination countries and mechanisms}
Total Gaps: {N} ({N} high, {N} medium, {N} low)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
{If DPIA required: 1. Run $arckit-dpia — DPIA required (2+ criteria met)}
{If French deployment: Run $arckit-fr-rgpd — CNIL-specific requirements}
{If AI: Run $arckit-eu-ai-act — AI and personal data intersection}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Important Notes
Member-state neutral: This command covers EU GDPR only. For French CNIL-specific requirements (cookies, HDS, age of consent 15), run $arckit-fr-rgpd after this assessment.
Legitimate interests for public authorities: Article 6(1)(f) legitimate interests CANNOT be used by public authorities for tasks in the exercise of official authority. Flag this explicitly.
Schrems II is ongoing: Even with the EU-US Data Privacy Framework (DPF), Transfer Impact Assessments remain best practice. DPF is subject to ongoing CJEU challenge.
DPIA is a legal requirement: When 2+ EDPB criteria are met, the DPIA is mandatory before processing starts. Non-compliance can result in supervisory authority enforcement.
Use Write Tool: GDPR assessments are typically 3,000–6,000 words. Always use the Write tool.
✅ Assessment document created at projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
✅ Organisation role determined (controller / processor / joint)
✅ Lead supervisory authority identified
✅ All processing activities mapped to Article 6 legal basis
✅ Special category data mapped to Article 9 conditions
✅ EDPB 9-criteria DPIA screening completed
✅ Data subject rights implementation assessed (Articles 15–22)
✅ International transfers assessed with Schrems II requirements
✅ Processor inventory with DPA compliance checked
✅ 72-hour breach notification process assessed
✅ National supervisory authority map populated
✅ Document classified OFFICIAL-SENSITIVE
✅ French deployment flagged for $arckit-fr-rgpd follow-up
Example Usage
$arckit-eu-rgpd Assess GDPR compliance for a French e-commerce platform expanding to Germany and Spain, processing purchase history, behavioural analytics, and email marketing, using AWS eu-west-3 (Paris) with Salesforce Marketing Cloud (US-based processor)
$arckit-eu-rgpd GDPR assessment for 001 — SaaS HR platform operating across 5 EU member states, processing employee data, using US-based payroll sub-processor
$arckit-eu-rgpd Assess GDPR for a healthcare research project processing anonymised patient data across FR, DE, NL — assess whether anonymisation is complete
Suggested Next Steps
After completing this command, consider running:
$arckit-dpia -- Run a full Data Protection Impact Assessment if screening flags 2+ high-risk criteria (when DPIA screening score is 2 or more)
$arckit-fr-rgpd -- Add French CNIL-specific obligations on top of the EU GDPR baseline (when Project processes personal data of French residents or is operated by a French entity)
$arckit-eu-ai-act -- Assess AI Act obligations where AI systems process personal data (when Project uses AI or automated decision-making involving personal data)
