README.md

metadata

title: GDPR Interactive Compliance Explorer & Knowledge Graph
emoji: ⚖️
colorFrom: indigo
colorTo: blue
sdk: static
pinned: false
license: apache-2.0
short_description: GDPR Knowledge Graph & Compliance Explorer
tags:
  - legal
  - gdpr
  - knowledge-graph
  - compliance
  - devsecops
  - privacy-engineering
  - knowledge-engineering
  - symbolic-ai

GDPR Interactive Compliance Explorer & Knowledge Graph

An offline-first, client-side legal analytics and privacy engineering platform for Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), featuring 936 line-by-line normative triples, interactive Cytoscape.js knowledge graph, executable W3C SHACL/Prolog compliance engines, automated Article 35 DPIA risk wizard, DSAR SLA manager, and DevSecOps static linter.

---

🧠 Knowledge Engineering Architecture & Methodology

Traditional legal-tech solutions rely heavily on stochastic Large Language Models (LLMs) that frequently hallucinate legal citations, miss nuanced cross-article conditions, or misattribute passive statutory duties. This platform is built upon a deterministic 6-Phase Knowledge Engineering Pipeline:

[EUR-Lex Official Journal CELEX:32016R0679]
                     │
                     ▼
  Phase 1: Statutory Knowledge Acquisition & Normalization
                     │
                     ▼
  Phase 2: Semantic Disambiguation & Active-Voice Attribution
                     │
                     ▼
  Phase 3: Formal Ontological Modeling (936 Triples & Graph)
                     │
                     ▼
  Phase 4: Executable Compliance Engines (W3C SHACL & Prolog)
                     │
                     ▼
  Phase 5: Privacy-as-Code & Privacy Engineering Operations
                     │
                     ▼
  Phase 6: 4-Tier Cryptographic SHA-256 Provenance Ledger

1. Statutory Knowledge Acquisition & Text Normalization

• Authoritative Grounding: Direct, deterministic ingestion from the Official Journal of the European Union (OJ L 119, 4.5.2016, p. 1-88; CELEX:32016R0679).
• Exhaustive Statutory Scope: 100% complete line-by-line coverage across all 99 Articles (Chapters I–XI) and 173 Recitals.
• Zero Hallucination Guarantee: Every statement is anchored to its verbatim canonical text snippet with automated SHA-256 hashing.

2. Semantic Disambiguation & Active-Voice Attribution

• Challenge: EU legal drafting extensively uses passive voice (e.g., "personal data shall be processed lawfully..."), creating ambiguity about which actor bears liability.
• Solution: Complete agent disambiguation mapping statutory duties to explicit legal actors:
  • Data Controller
  • Joint Controller
  • Data Processor / Sub-processor
  • Data Subject
  • Supervisory Authority (DPA)
  • European Data Protection Board (EDPB)
  • European Commission

3. Formal Ontological Modeling

• 936 Normative Subject-Predicate-Object (SPO) Triples:
  • Fully categorized by Modal Deontic Operators:
    • OBLIGATION: Mandatory statutory duties ("shall", "must")
    • PROHIBITION: Explicit legal bans ("shall not", "prohibited")
    • PERMISSION: Conditional statutory rights or derogations ("may", "permitted")
    • DEFINITION: Foundational ontological terms ("means", "denotes")
    • SANCTION: Statutory penalty thresholds under Article 83
• Unified Knowledge Graph Topology:
  • 3,212 Legal Nodes: Concepts, processing operations, actor roles, and rights.
  • 4,500+ Relational Edges: Cross-article references, conditional requirements, delegation flows, and jurisdictional bridges.
• Domain Data Dictionary:
  • 21 domain classes, 1,000+ controlled vocabulary terms, and standardized predicate taxonomies.

4. Executable Compliance Engines & Symbolic Reasoning

• W3C SHACL (Shapes Constraint Language): Executable RDF/Turtle validation shapes (gdpr_shacl_shapes.ttl) for automated compliance checks against Article 30 ROPA records and Article 37 DPO appointments.
• EDPB Guidelines 04/2022 Statutory Penalty Calculator: Two-tier dynamic calculation engine evaluating turnover percentages (2% vs 4%) and statutory ceilings (€10M vs €20M).
• Cross-Regulatory Harmonization: Formal cross-walks aligning GDPR requirements against ISO/IEC 27701:2019 (PIMS), ISO/IEC 27001:2022, CCPA/CPRA, and HIPAA Security Rule.

5. Privacy-as-Code & Privacy Engineering Operations

• DevSecOps Static Linter: In-browser and CLI static analysis for Terraform (aws_s3_bucket, google_storage_bucket, azurerm_storage_account) and OpenAPI 3.0 specs with standard SARIF v2.1.0 reports.
• Article 35 DPIA Wizard: Automated EDPB WP 248 rev.01 high-risk processing screening with inherent/residual risk scoring matrix and cryptographic audit certificate generation.
• DSAR SLA Workflow Orchestrator: Article 12(3) statutory 1-month SLA tracking, Article 17(3) statutory exemption validation, and formal legal response drafting.

6. Cryptographic Provenance Ledger

• 4-Tier SHA-256 verification tree ensuring tamper-evident legal certainty from primary EUR-Lex gazette down to granular UI elements.

---

🔒 100% Client-Side Privacy Architecture

• Zero Server-Side Storage: Runs entirely within your browser client.
• No External API Dependencies: All 936 triples, 3,212 entities, SHACL shapes, and DPIA rules are embedded statically.
• Air-Gapped Ready: Operates completely offline without sending data over external networks.