GDPR Compliance¶

PrimeStamp provides cryptographically timestamped evidence for GDPR compliance. Every consent record, data processing log, erasure proof, and breach notification receives a verifiable timestamp that can demonstrate regulatory compliance to auditors and supervisory authorities.

Features¶

Consent record stamping with cryptographic proof (Article 6/7)
Data processing activity logs (Article 30)
Right-to-erasure proof of deletion (Article 17)
Data breach notification timestamps (Article 33/34)
Data Subject Access Request (DSAR) tracking (Articles 15--22)
Audit report generation with Merkle-linked records

Quick Start¶

from primestamp.integrations.gdpr import (
    GDPRComplianceManager,
    ConsentRecord,
    LawfulBasis,
)

manager = GDPRComplianceManager()

# Stamp a consent record
consent = ConsentRecord(
    data_subject_id="user_123",
    purpose="marketing_emails",
    lawful_basis=LawfulBasis.CONSENT.value,
    given=True,
    data_categories=["contact", "behavioral"],
    retention_period_days=365,
)
result = await manager.stamp_consent(consent, preset="standard")
print(f"Consent hash: {result['content_hash']}")

Track when and how consent was given or withdrawn.

consent = ConsentRecord(
    data_subject_id="user_456",
    purpose="analytics",
    lawful_basis="legitimate_interests",
    given=True,
    data_categories=["behavioral"],
    third_parties=["analytics-provider.com"],
    consent_method="explicit",
    version="2.1",
)
stamped = await manager.stamp_consent(consent)

Field	Required	Description
`data_subject_id`	Yes	Identifier for the data subject.
`purpose`	Yes	Purpose of data processing.
`lawful_basis`	No	GDPR Article 6 basis. Default: `consent`.
`given`	No	Whether consent was granted. Default: `True`.
`data_categories`	No	Categories of personal data involved.
`third_parties`	No	Third parties data is shared with.
`retention_period_days`	No	How long data will be retained.

Erasure Proofs (Article 17)¶

Generate cryptographic proof that personal data was deleted.

from primestamp.integrations.gdpr import ErasureProof

proof = ErasureProof(
    data_subject_id="user_123",
    data_categories_erased=["contact", "financial"],
    systems_erased_from=["main-db", "analytics-db", "backup-store"],
    erasure_method="deletion",
)
stamped = await manager.stamp_erasure(proof, preset="archival")

Breach Notifications (Article 33/34)¶

Timestamp breach discovery and notification events to demonstrate the 72-hour reporting requirement.

from primestamp.integrations.gdpr import BreachNotification, BreachSeverity

breach = BreachNotification(
    description="Unauthorized access to user contact database",
    severity=BreachSeverity.HIGH.value,
    data_categories_affected=["contact", "basic_identity"],
    subjects_affected_count=1500,
    containment_measures=["Access revoked", "Credentials rotated"],
)
stamped = await manager.stamp_breach(breach, preset="archival")

DSAR Tracking¶

Track Data Subject Access Requests through their lifecycle.

from primestamp.integrations.gdpr import DSARRecord, DSARType

dsar = DSARRecord(
    data_subject_id="user_789",
    request_type=DSARType.ACCESS.value,
)
stamped = await manager.stamp_dsar(dsar)

Audit Reports¶

Generate a summary report of all GDPR compliance records.

report = manager.generate_audit_report()
print(f"Total records: {report['total_records']}")
print(f"Consent records: {report['consent_records']}")
print(f"Erasure proofs: {report['erasure_proofs']}")
print(f"Report hash: {report['report_hash']}")

Lawful Bases¶

Basis	GDPR Article	Constant
Consent	Art. 6(1)(a)	`LawfulBasis.CONSENT`
Contract	Art. 6(1)(b)	`LawfulBasis.CONTRACT`
Legal obligation	Art. 6(1)(c)	`LawfulBasis.LEGAL_OBLIGATION`
Vital interests	Art. 6(1)(d)	`LawfulBasis.VITAL_INTERESTS`
Public task	Art. 6(1)(e)	`LawfulBasis.PUBLIC_TASK`
Legitimate interests	Art. 6(1)(f)	`LawfulBasis.LEGITIMATE_INTERESTS`

Preset Selection

Use archival preset for erasure proofs and breach notifications -- these records may need to be verified years later and benefit from multiple blockchain anchors.