---
title: GDPR Interactive Compliance Explorer & Knowledge Graph
emoji: ⚖️
colorFrom: indigo
colorTo: blue
sdk: static
pinned: false
license: apache-2.0
short_description: GDPR Knowledge Graph & Compliance Explorer
tags:
- legal
- gdpr
- knowledge-graph
- compliance
- devsecops
- privacy-engineering
- knowledge-engineering
- symbolic-ai
---

# GDPR Interactive Compliance Explorer & Knowledge Graph

[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
[![W3C SHACL](https://img.shields.io/badge/W3C-SHACL_Validated-brightgreen.svg)](https://www.w3.org/TR/shacl/)
[![Provenance: SHA-256](https://img.shields.io/badge/Provenance-SHA--256_Ledger-purple.svg)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
[![Static Security: SARIF v2.1.0](https://img.shields.io/badge/SARIF-v2.1.0_Compliant-orange.svg)](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html)

An offline-first, client-side legal analytics and privacy engineering platform for **Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR)**, featuring 936 line-by-line normative triples, interactive Cytoscape.js knowledge graph, executable W3C SHACL/Prolog compliance engines, automated Article 35 DPIA risk wizard, DSAR SLA manager, and DevSecOps static linter.

---

## 🧠 Knowledge Engineering Architecture & Methodology

Traditional legal-tech solutions rely heavily on stochastic Large Language Models (LLMs) that frequently hallucinate legal citations, miss nuanced cross-article conditions, or misattribute passive statutory duties. This platform is built upon a deterministic **6-Phase Knowledge Engineering Pipeline**:

```
[EUR-Lex Official Journal CELEX:32016R0679]
                     │
                     ▼
  Phase 1: Statutory Knowledge Acquisition & Normalization
                     │
                     ▼
  Phase 2: Semantic Disambiguation & Active-Voice Attribution
                     │
                     ▼
  Phase 3: Formal Ontological Modeling (936 Triples & Graph)
                     │
                     ▼
  Phase 4: Executable Compliance Engines (W3C SHACL & Prolog)
                     │
                     ▼
  Phase 5: Privacy-as-Code & Privacy Engineering Operations
                     │
                     ▼
  Phase 6: 4-Tier Cryptographic SHA-256 Provenance Ledger
```

### 1. Statutory Knowledge Acquisition & Text Normalization
- **Authoritative Grounding**: Direct, deterministic ingestion from the Official Journal of the European Union (OJ L 119, 4.5.2016, p. 1-88; CELEX:32016R0679).
- **Exhaustive Statutory Scope**: 100% complete line-by-line coverage across **all 99 Articles** (Chapters I–XI) and **173 Recitals**.
- **Zero Hallucination Guarantee**: Every statement is anchored to its verbatim canonical text snippet with automated SHA-256 hashing.

### 2. Semantic Disambiguation & Active-Voice Attribution
- **Challenge**: EU legal drafting extensively uses passive voice (e.g., *"personal data shall be processed lawfully..."*), creating ambiguity about which actor bears liability.
- **Solution**: Complete agent disambiguation mapping statutory duties to explicit legal actors:
  - `Data Controller`
  - `Joint Controller`
  - `Data Processor` / `Sub-processor`
  - `Data Subject`
  - `Supervisory Authority (DPA)`
  - `European Data Protection Board (EDPB)`
  - `European Commission`

### 3. Formal Ontological Modeling
- **936 Normative Subject-Predicate-Object (SPO) Triples**:
  - Fully categorized by Modal Deontic Operators:
    - **`OBLIGATION`**: Mandatory statutory duties (*"shall"*, *"must"*)
    - **`PROHIBITION`**: Explicit legal bans (*"shall not"*, *"prohibited"*)
    - **`PERMISSION`**: Conditional statutory rights or derogations (*"may"*, *"permitted"*)
    - **`DEFINITION`**: Foundational ontological terms (*"means"*, *"denotes"*)
    - **`SANCTION`**: Statutory penalty thresholds under Article 83
- **Unified Knowledge Graph Topology**:
  - **3,212 Legal Nodes**: Concepts, processing operations, actor roles, and rights.
  - **4,500+ Relational Edges**: Cross-article references, conditional requirements, delegation flows, and jurisdictional bridges.
- **Domain Data Dictionary**:
  - 21 domain classes, 1,000+ controlled vocabulary terms, and standardized predicate taxonomies.

### 4. Executable Compliance Engines & Symbolic Reasoning
- **W3C SHACL (Shapes Constraint Language)**: Executable RDF/Turtle validation shapes (`gdpr_shacl_shapes.ttl`) for automated compliance checks against Article 30 ROPA records and Article 37 DPO appointments.
- **EDPB Guidelines 04/2022 Statutory Penalty Calculator**: Two-tier dynamic calculation engine evaluating turnover percentages (2% vs 4%) and statutory ceilings (€10M vs €20M).
- **Cross-Regulatory Harmonization**: Formal cross-walks aligning GDPR requirements against **ISO/IEC 27701:2019 (PIMS)**, **ISO/IEC 27001:2022**, **CCPA/CPRA**, and **HIPAA Security Rule**.

### 5. Privacy-as-Code & Privacy Engineering Operations
- **DevSecOps Static Linter**: In-browser and CLI static analysis for Terraform (`aws_s3_bucket`, `google_storage_bucket`, `azurerm_storage_account`) and OpenAPI 3.0 specs with standard SARIF v2.1.0 reports.
- **Article 35 DPIA Wizard**: Automated EDPB WP 248 rev.01 high-risk processing screening with inherent/residual risk scoring matrix and cryptographic audit certificate generation.
- **DSAR SLA Workflow Orchestrator**: Article 12(3) statutory 1-month SLA tracking, Article 17(3) statutory exemption validation, and formal legal response drafting.

### 6. Cryptographic Provenance Ledger
- 4-Tier SHA-256 verification tree ensuring tamper-evident legal certainty from primary EUR-Lex gazette down to granular UI elements.

---

## 🔒 100% Client-Side Privacy Architecture
- **Zero Server-Side Storage**: Runs entirely within your browser client.
- **No External API Dependencies**: All 936 triples, 3,212 entities, SHACL shapes, and DPIA rules are embedded statically.
- **Air-Gapped Ready**: Operates completely offline without sending data over external networks.