| name | arckit-eu-rgpd |
| description | [COMMUNITY] Generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — legal basis mapping, data subject rights, transfers, DPIA screening, and breach notification across all member states |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate a GDPR Compliance Assessment (EU 2016/679) for any organisation processing personal data of EU/EEA residents. This command takes a member-state-neutral approach to the EU GDPR baseline. For French-specific CNIL obligations, run /skill:arckit-fr-rgpd after this assessment.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
- DATA (Data Model) — Extract: all entities with personal data, special category data (Article 9), data subjects, data flows to third parties, retention periods, data classifications
- If missing: warn that GDPR assessment requires a data model to identify what personal data is processed and how
RECOMMENDED (read if available, note if missing):
- REQ (Requirements) — Extract: data requirements (DR-xxx), compliance requirements (NFR-C-xxx), security requirements (NFR-SEC-xxx), integration points that involve personal data transfer
- STKE (Stakeholder Analysis) — Extract: data subject categories, vulnerable groups, organisation's role (controller / processor), RACI for data governance
- PRIN (Architecture Principles, 000-global) — Extract: privacy by design principles, data minimisation, retention policies
OPTIONAL (read if available, skip silently):
- RISK (Risk Register) — Extract: existing privacy risks, data breach history, third-party risks
- SECD (Secure by Design) — Extract: security controls relevant to Article 32 assessment
Step 0b: Read external documents and policies
- Read any external documents in
external/ — extract existing privacy policies, Records of Processing Activities (RoPA), Data Processing Agreements, previous DPIA reports, transfer impact assessments
- Read any global policies in
000-global/policies/ — extract organisational privacy policy, data retention schedule, data classification scheme, DPO mandate
- Citation traceability: When referencing content from external documents, follow
.arckit/references/citation-instructions.md.
Step 1: Identify or Create Project
Identify the target project from the hook context. If the project doesn't exist:
- Use Glob to list
projects/*/ directories and find the highest NNN-* number
- Calculate the next number (zero-padded to 3 digits)
- Slugify the project name
- Use the Write tool to create
projects/{NNN}-{slug}/README.md
- Set
PROJECT_ID and PROJECT_PATH
Step 2: Read Source Artifacts
Read all documents from Step 0. Identify:
- Role: controller / processor / joint controller (from stakeholder analysis or user input)
- Special category data presence (Article 9) → stricter requirements
- International transfers → Schrems II / TIA requirements
- Data subjects: consumers, employees, patients, children?
- Lead supervisory authority: determined by the controller's main establishment
Step 3: GDPR Template Reading
Read the template (with user override support):
- First, check if
.arckit/templates/eu-rgpd-template.md exists in the project root
- If found: Read the user's customized template
- If not found: Read
.arckit/templates/eu-rgpd-template.md
- Then read
.arckit/templates/_partials/RENDERING.md and resolve the <!-- DOC-CONTROL-HEADER --> marker in the template before writing. Do not hand-write the Document Control table: the partial RENDERING.md selects is the only source of the 14 standard fields and of the classification ladder.
Step 4: DPIA Screening (Article 35 — Automated)
Based on the data model and requirements, automatically score the EDPB 9 criteria:
| # | Criterion | Score YES if... |
|---|
| 1 | Evaluation/scoring | AI/ML profiling, credit scoring, behavioural profiling |
| 2 | Automated decisions | Legal/significant effect without human review |
| 3 | Systematic monitoring | Continuous tracking, surveillance, CCTV, web analytics at scale |
| 4 | Sensitive/special category data | ANY Article 9 category (health, biometric, genetic, etc.) |
| 5 | Large-scale processing | > 5,000 data subjects OR national/regional scope |
| 6 | Matching/combining datasets | Multiple data sources joined for new purposes |
| 7 | Vulnerable data subjects | Children, elderly, patients, job seekers |
| 8 | Innovative technology | AI/ML, biometrics, IoT, blockchain, facial recognition |
| 9 | Prevents exercising rights | No SAR/deletion/portability mechanism |
DPIA Decision:
- 2+ criteria: DPIA REQUIRED (Article 35) → recommend running
/skill:arckit-dpia
- 1 criterion: DPIA RECOMMENDED
- 0 criteria: DPIA NOT REQUIRED (but document the screening)
Step 5: Generate GDPR Assessment
CRITICAL: Use the Write tool to create the assessment document.
-
Detect version: Check for existing ARC-{PROJECT_ID}-RGPD-v*.md files:
- No existing file → VERSION="1.0"
- Existing file → minor increment if refreshed, major if scope changed
-
Auto-populate Document Control:
- Document ID:
ARC-{PROJECT_ID}-RGPD-v{VERSION}
- Status: DRAFT
- Created Date: {current_date}
- Next Review Date: {current_date + 12 months}
- Classification: OFFICIAL-SENSITIVE
- Lead Supervisory Authority: determine from controller's main EU establishment
-
Section 1: Scope and Role Determination
- Organisation role (controller / processor / joint controller / sub-processor)
- Data categories processed (standard personal data, Article 9 special categories, Article 10 criminal data)
-
Section 2: Lawful Basis Assessment (Articles 6 and 9)
- Map each processing activity to Article 6(1) legal basis
- Map each special category processing to Article 9(2) condition
- Consent management: if consent used, assess GDPR consent requirements
- Legitimate interests: flag if used — three-part test required (purpose, necessity, balancing)
-
Section 3: Privacy by Design and Default (Article 25)
- Data minimisation, purpose limitation, storage limitation
- Pseudonymisation, encryption defaults
- Privacy-friendly default settings
-
Section 4: Data Subject Rights (Articles 15–22)
- Implementation mechanism for each right with response times
- Flag any rights without implementation mechanism as gap
-
Section 5: Records of Processing Activities (Article 30)
- RoPA mandatory for organisations with 250+ employees (or processing high-risk/special category data)
- RoPA location and maintenance status
-
Section 6: DPIA Assessment
- Copy DPIA screening results from Step 4
- DPIA status: conducted / required / not required
-
Section 7: Data Processors and Sub-Processors (Article 28)
- Processor inventory from data model data flows
- DPA compliance checklist (processing only on instructions, sub-processor controls, audit rights, deletion/return)
Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks pass.
Write the document to:
projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
Step 6: Summary Output
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ GDPR Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
🔒 Classification: OFFICIAL-SENSITIVE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Assessment Summary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Role: {Controller / Processor / Joint Controller}
Lead DPA: {Authority name}
Data Subjects: {Categories}
Special Category Data: {Yes (categories) / No}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 DPIA Screening: {N}/9 criteria → {REQUIRED / RECOMMENDED / NOT REQUIRED}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
International Transfers: {N} transfers identified
{List destination countries and mechanisms}
Total Gaps: {N} ({N} high, {N} medium, {N} low)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Next steps:
{If DPIA required: 1. Run /skill:arckit-dpia — DPIA required (2+ criteria met)}
{If French deployment: Run /skill:arckit-fr-rgpd — CNIL-specific requirements}
{If AI: Run /skill:arckit-eu-ai-act — AI and personal data intersection}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Important Notes
- Member-state neutral: This command covers EU GDPR only. For French CNIL-specific requirements (cookies, HDS, age of consent 15), run
/skill:arckit-fr-rgpd after this assessment.
- Legitimate interests for public authorities: Article 6(1)(f) legitimate interests CANNOT be used by public authorities for tasks in the exercise of official authority. Flag this explicitly.
- Schrems II is ongoing: Even with the EU-US Data Privacy Framework (DPF), Transfer Impact Assessments remain best practice. DPF is subject to ongoing CJEU challenge.
- DPIA is a legal requirement: When 2+ EDPB criteria are met, the DPIA is mandatory before processing starts. Non-compliance can result in supervisory authority enforcement.
- Use Write Tool: GDPR assessments are typically 3,000–6,000 words. Always use the Write tool.
Key References
Success Criteria
- ✅ Assessment document created at
projects/{project_id}/ARC-{PROJECT_ID}-RGPD-v{VERSION}.md
- ✅ Organisation role determined (controller / processor / joint)
- ✅ Lead supervisory authority identified
- ✅ All processing activities mapped to Article 6 legal basis
- ✅ Special category data mapped to Article 9 conditions
- ✅ EDPB 9-criteria DPIA screening completed
- ✅ Data subject rights implementation assessed (Articles 15–22)
- ✅ International transfers assessed with Schrems II requirements
- ✅ Processor inventory with DPA compliance checked
- ✅ 72-hour breach notification process assessed
- ✅ National supervisory authority map populated
- ✅ Document classified OFFICIAL-SENSITIVE
- ✅ French deployment flagged for
/skill:arckit-fr-rgpd follow-up
Example Usage
/skill:arckit-eu-rgpd Assess GDPR compliance for a French e-commerce platform expanding to Germany and Spain, processing purchase history, behavioural analytics, and email marketing, using AWS eu-west-3 (Paris) with Salesforce Marketing Cloud (US-based processor)
/skill:arckit-eu-rgpd GDPR assessment for 001 — SaaS HR platform operating across 5 EU member states, processing employee data, using US-based payroll sub-processor
/skill:arckit-eu-rgpd Assess GDPR for a healthcare research project processing anonymised patient data across FR, DE, NL — assess whether anonymisation is complete
Suggested Next Steps
After completing this command, consider running:
/skill:arckit-dpia -- Run a full Data Protection Impact Assessment if screening flags 2+ high-risk criteria (when DPIA screening score is 2 or more)/skill:arckit-fr-rgpd -- Add French CNIL-specific obligations on top of the EU GDPR baseline (when Project processes personal data of French residents or is operated by a French entity)/skill:arckit-eu-ai-act -- Assess AI Act obligations where AI systems process personal data (when Project uses AI or automated decision-making involving personal data)
