Skip to main content
EU GDPR · DPA Available · SCCs Included

GDPR
Compliance

G8KEPR implements the technical controls required by the GDPR Security Rule. We provide a Data Processing Agreement, Standard Contractual Clauses for EU data transfers, and full data subject rights tooling.

90%
Readiness score
DPA
Available to sign
97%
Art. 22 coverage
SCCs
EU transfers

What our 90% readiness score means. G8KEPR covers the technical controls for most GDPR articles and will sign a DPA and SCCs before your deployment processes EU personal data. Two articles are partially implemented: Art. 17 (individual DSAR erasure pipeline in progress) and Art. 25 (Privacy by Design documentation in progress). We are not formally audited by a third-party GDPR assessor. The 90% score is based on internal controls tracking.

Article-by-Article Coverage

GDPR Technical Controls

The articles most relevant to a data processor running an AI gateway. Status is based on actual implementation, not aspirational roadmap.

Art. 5
Principles of Processing
Covered

Lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity are all enforced at the API layer.

Art. 6
Lawful Basis for Processing
Covered

Consent flows, legitimate interests assessment, and contractual necessity are captured per-request via the consent management API.

Art. 17
Right to Erasure
Partial

Organisation-level erasure is fully implemented (tenant delete + cascade). Individual DSAR erasure requests are accepted and tracked; the full async purge pipeline is in progress.

Art. 20
Right to Data Portability
Covered

GDPR Art. 20-compatible export in structured JSON and CSV. All user-provided data and derived decisions are included.

Art. 22
Automated Decision-Making
Covered

97% coverage. logic_involved + significance_and_consequences fields on all AI decision responses; /explainability endpoint + regulator-ready export bundle.

Art. 25
Privacy by Design
Partial

Row-Level Security, data minimisation headers, and field-level encryption are in place. Formal PbD documentation and DPIA templates are in progress.

Art. 30
Records of Processing (RoPA)
Covered

Full RoPA API: create, update, export for regulators. Fields: purposes, lawful basis, data categories, recipients, third-country transfers, retention period.

Art. 32
Security of Processing
Covered

AES-256 at rest, TLS 1.3 in transit, pseudonymisation, access controls, audit logging, and incident response procedures all documented and enforced.

Art. 22 — 97% Coverage

Automated Decision-Making & Explainability

Article 22 is the hardest GDPR article for AI systems to satisfy — it requires meaningful explanation of automated decisions that significantly affect people. G8KEPR implements this at the API response level, not just as an audit log.

logic_involved field

Every AI decision response includes a structured explanation of which rules, models, or thresholds triggered the outcome.

significance_and_consequences field

Human-readable description of what the decision means for the affected individual — required by Art. 22(2)(b).

Explainability endpoint

GET /api/decisions/{id}/explain returns the full decision audit trail in a format designed for DPOs and regulators.

Regulator export bundle

Signed, tamper-proof export package for supervisory authority requests. Includes decision logic, input data, and outcome.

Data Subject Rights

Access (Art. 15)Covered

DSARs accepted via API and compliance dashboard. Response timeline tracked against 30-day statutory deadline.

Rectification (Art. 16)Covered

Data correction requests routed to the owning system. Audit trail records who changed what and when.

Erasure (Art. 17)Partial

Org-level cascade delete is fully implemented. Individual-level async purge pipeline in progress — stubs exist, full execution not yet deployed.

Portability (Art. 20)Covered

Structured JSON/CSV export of all personal data. Machine-readable, includes AI decision history.

Objection (Art. 21)Covered

Objection to automated profiling is honoured via the /opt-out endpoint. Consent withdrawal stops processing immediately.

Explanation (Art. 22)Covered

97% coverage. Every AI-generated decision includes a human-readable explanation and a structured regulator export.

Data Processing Agreement

Getting a DPA Signed

A DPA is required under Art. 28 before G8KEPR processes personal data on your behalf. It documents the subject matter, duration, nature, and purpose of the processing. Typical turnaround is 1–2 business days.

1
Request

Contact us and tell us which personal data categories your deployment will process and the lawful basis.

2
Review scope

We confirm processing activities, sub-processors, data transfers, and retention periods. We list all sub-processors upfront.

3
Execute + SCCs

Sign electronically. If you are transferring data outside the EU/EEA, EU Standard Contractual Clauses (Module 2 — controller to processor) are attached automatically.

Technical Safeguards (Art. 32)

Appropriate security of processing

PseudonymisationTenant data keyed to opaque org_id_hash — never raw identifiers in logs
Encryption at restAES-256 for all personal data in PostgreSQL
Encryption in transitTLS 1.3, no fallback to TLS 1.2
Ongoing confidentialityRLS ensures cross-tenant data access is impossible at the DB layer
ResilienceCircuit breakers, health checks, async audit writes — processing continues under failure
Incident response72-hour breach notification target to meet Art. 33 obligation

Records of Processing (Art. 30)

RoPA API — regulator-exportable

Purposes of processing
Lawful basis per activity
Data categories and subjects
Recipient organisations
Third-country transfer records
Retention periods
Security measures description
DPO contact details

Export via the compliance dashboard or API in JSON/CSV. Signed for regulator submission.

Breach Notification (Art. 33/34)

72-hour SA notification obligation

< 2hr
Detection → containment
< 24hr
Controller notification
72hr
SA notification deadline
Art. 17 — Partial

Right to Erasure & Machine Unlearning

The right to erasure is one of the most technically complex GDPR rights for AI systems. G8KEPR has implemented the parts that cover most use cases, and is actively building the remainder.

Org-level cascade delete

Full organisation + all tenant data deleted on request. Immediate, synchronous, irreversible.

DSAR erasure request intake

POST /gdpr/dsar/erasure creates a tracked request with deadline calculation and audit trail.

Individual data purge pipeline

Async pipeline to purge a specific data subject across all tables. Stubs exist; full execution in progress.

Machine unlearning (AI training data)

Removal of a data subject from AI model training sets. Stub endpoint exists; full retraining-free erasure pipeline is not yet built.

EU Data Residency

Keep data in the EU — self-hosted or cloud

Self-hosted G8KEPR runs in any region you choose. Deploy in Frankfurt, Amsterdam, or Dublin and personal data never crosses EU borders. No Chapter V transfer mechanisms needed.

Deploy in any EU cloud region
No mandatory data egress to G8KEPR infrastructure
SCCs automatically included if you use our SaaS
Data residency selection in the compliance dashboard

DPO & Audit Access

DPO dashboardDedicated view showing open DSARs, consent withdrawals, and breach status
Audit log exportFull processing activity log exportable for supervisory authority requests
DSAR deadline tracker30-day Art. 15 response clock auto-calculated and alerted
Sub-processor listPublished and versioned — changes trigger DPO notification
GDPR Ready

Processing EU personal data? Start with the DPA.

We will walk you through the processing activities, sign the DPA with SCCs, and help you configure data residency and retention before you go live.