Back to Guides

A short AI-narrated film with English captions. Pressing play loads the YouTube player. Watch on YouTube

Guide Origin: Community | ArcKit Version: [VERSION]

/arckit:eu-rgpd generates a GDPR (Regulation EU 2016/679) compliance assessment. It is member-state-neutral and covers all EEA supervisory authorities, cross-border transfers, breach notification, and DPO obligations.

Inputs

Artefact Purpose
Requirements (ARC-<id>-REQ-v1.0.md) Processing activities and data flows
Data model (ARC-<id>-DATA-v1.0.md) Personal data categories and entities
DPIA (ARC-<id>-DPIA-v1.0.md) High-risk processing already assessed
Risk register Data breach and compliance risks

Command

/arckit:eu-rgpd Assess GDPR compliance for <project or data processing activity>

In Claude Code the overlay installs as its own plugin, arckit-eu, so the command is /arckit-eu:eu-rgpd.

Output: projects/<id>/ARC-<id>-RGPD-v1.0.md

Auto-versioning: Re-running increments the version automatically.

Assessment Structure

Section Contents
Processing Inventory All processing activities, lawful basis, purpose
Data Subjects Categories of data subjects and their rights
DPO Obligation Whether a DPO is required and their role
Data Minimisation Retention periods, minimisation measures
International Transfers SCCs, BCRs, adequacy decisions
Breach Notification 72-hour reporting capability
Data Subject Rights SAR, erasure, portability, objection mechanisms
Third-Party Processors DPA obligations, processor agreements
Gap Analysis Gaps with priority and remediation plan

One-Page Workflow

Phase Key Activities ArcKit Commands
Discovery Data model and requirements /arckit:requirements, /arckit:data-model
Risk DPIA for high-risk processing /arckit:dpia
Assessment GDPR compliance assessment /arckit:eu-rgpd
French layer CNIL-specific requirements /arckit:fr-rgpd

Review Checklist

  • Lawful basis documented for each processing activity.
  • DPO obligation assessed (public authority / large-scale / special categories).
  • Data subject rights mechanisms operational (SAR response ≤ 1 month).
  • International transfer safeguards in place (SCCs / BCRs / adequacy).
  • 72-hour breach notification capability assessed.
  • Processor agreements (Article 28) in place for all processors.
  • Retention periods defined and enforced.
  • DPIA conducted for high-risk processing (run /arckit:dpia first).

Key Notes

  • French layer: Run /arckit:fr-rgpd for CNIL-specific obligations (health data, cookies, age 15 for minors).
  • DPIA: For high-risk processing, a DPIA under Article 35 is mandatory — run /arckit:dpia before this command.
  • Scope: This command covers EU GDPR. UK GDPR (post-Brexit) is covered by /arckit:dpia with UK ICO context.