GDPR Compliance Pack

• Consent Status Validation (Article 6)
• Children Data Protections (Article 8)

• DPO Designation Check (Article 37)

• Marketing Opt-Out Mechanism (Article 21)

• At-Rest Encryption Requirement (Article 32)
• In-Transit Encryption (TLS) (Article 32)

• Special Category Data Protection (Article 9)

• Privacy by Design Default (Article 25)

• DPIA Requirement Validation (Article 35)

• Lawful Basis Documentation (Article 6)

• Records of Processing (ROPA) (Article 30)

• Right to Data Access (DSAR) (Article 15)

• Data Retention Period Enforcement (Article 5)
• Right to Be Forgotten (Erasure) (Article 17)

• Third Country Transfer Basis (Articles 44-49)

{ "field": "consent_status", "operator": "equals", "value": "pending" }

Processing requires valid consent.

• Average Fine: €50M (Google case for lack of transparency/consent)
• Breach Example: Ad-tech firm processing location data without clear opt-in

{ "field": "age", "operator": "less_than", "value": 16 }

Children’s data requires parental consent.

• Average Fine: €345M (TikTok — failing to protect children’s data)
• Breach Example: Gaming site collecting emails of 12-year-olds without age verification

{ "field": "encrypted", "operator": "equals", "value": false }

Personal data must be encrypted at rest.

• Average Fine: €18M (British Airways breach — lack of security measures)
• Breach Example: Hospital database leaked patient records because PII was stored in plain text

{ "field": "tls_enabled", "operator": "equals", "value": false }

Personal data in transit must be encrypted.

• Average Fine: €10M (Telecom company — lack of encryption for subscriber data packets)
• Breach Example: Web form submitting PII via HTTP instead of HTTPS

{ "field": "data_category", "operator": "contains", "value": "special_category" }

Special category data requires explicit consent.

• Average Fine: €35M (H&M case for processing sensitive employee data)
• Breach Example: Health app sharing biometric data with third parties without specific Art 9 consent

{
  "AND": [
    { "field": "deletion_requested", "operator": "equals", "value": true },
    { "field": "created_at", "operator": "exists", "value": null }
  ]
}

Personal data must not be retained beyond necessary period.

• Average Fine: €14.5M (Average for systemic retention failure)
• Breach Example: Real estate company fined for storing tenant data indefinitely

{ "field": "is_retrievable", "operator": "equals", "value": false }

Data subjects have right to access their data.

• Average Fine: €1M (Amazon — failing to provide full access to data)
• Breach Example: SaaS provider unable to export all user data during access request

{ "field": "deletion_requested", "operator": "equals", "value": true }

Check for records marked for deletion but not yet erased.

• Average Fine: €600k (Google Spain — “Right to be Forgotten” in search results)
• Breach Example: Bank failed to delete marketing profile after user closed account

{ "field": "lawful_basis", "operator": "not_exists", "value": null }

All processing must have documented lawful basis.

• Average Fine: €20M (General fine for lack of Art 6 justification)
• Breach Example: Company processing payroll data without defining a legal basis in their ROPA

{ "field": "ropa_entry_exists", "operator": "equals", "value": false }

Maintain a record of processing activities.

• Average Fine: €30k (Incomplete or missing ROPA)
• Breach Example: Logistics firm unable to provide processing logs during audit

{ "field": "dpo_assigned", "operator": "equals", "value": false }

Organizations must designate a DPO in specific cases.

• Average Fine: €50k (Average for failing to appoint DPO when required)
• Breach Example: Security firm fined for not appointing DPO despite large-scale monitoring

{ "field": "dpia_completed", "operator": "equals", "value": false }

Impact assessment required for high-risk processing.

• Average Fine: €200k (Failing to conduct DPIA for facial recognition)
• Breach Example: Retailer deploying AI tracking without preliminary impact study

{ "field": "marketing_consent", "operator": "equals", "value": true }

Email communications require opt-out mechanism.

• Average Fine: €400k (Deliveroo — lack of opt-out in promotional emails)
• Breach Example: E-commerce site ignoring unsubscribes for its weekly newsletter

{ "field": "privacy_by_default", "operator": "equals", "value": false }

Implement data protection by design and default.

• Average Fine: €100k (Software vendor — settings not private by default)
• Breach Example: Social app making profiles public automatically upon registration

{ "field": "transfer_basis", "operator": "not_exists", "value": null }

Transfers to third countries require legal basis.

• Average Fine: €1.2B (Meta — transferring data to US without valid basis)
• Breach Example: Cloud provider moving backup data to non-compliant region