Regulation (EU) 2016/679
Under the EU General Data Protection Regulation (2016/679), these policies protect the personal data of EU data subjects and any EU-facing activity that flows through AI interactions — including data exchange with EU subsidiaries, suppliers and trading partners. Coverage spans Article 9 special categories, the core principles, data-subject rights, cross-border transfer and processor governance.
Coverage focus
Detects national-ID numbers, passport formats, phone and address patterns of EU member states. German, French, Italian and Romanian formats are configured with priority.
Blocks processing of health data of EU data subjects. Unless explicit consent or a legal exception under Article 9 is proven, the default action is block.
Detects and blocks race and ethnic-origin data attributed to specific individuals.
Blocks political-opinion and party-affiliation data attributed to individuals.
Blocks religious or philosophical belief data attributed to individuals.
Blocks trade-union membership data attributed to individuals; anonymized aggregate statistics are allowed.
Detects and blocks genetic test results and genetic-profile data.
Blocks biometric templates and data processed for identification purposes.
Blocks sex-life and sexual-orientation data attributed to individuals.
Detects entry of more personal data than necessary for the processing purpose into AI systems. Personal-data redaction is applied before writing to logs, so the minimization principle is enforced at the platform level too.
Detects processing of personal data outside the legal basis and purpose defined for the project. Use that does not match the project-based lawful-basis selector raises a warning.
Enables person-level erasure of an EU data subject's personal data from AI interaction logs when an erasure request is received. Re-use of an erased person's data in later interactions is monitored with FLAG.
Prevents decisions producing legal effects about individuals (credit, hiring, contract termination) from being made fully automatically. Human approval (human-in-the-loop) is mandatory in these scenarios.
Blocks processing of personal data in consent-based scenarios before the consent record is verified. A processing-basis declaration is obtained from the user through the justify workflow and logged.
Blocks transfer of EU personal data to model endpoints in countries without an adequacy decision. Region-locked model routing sends EU data only to EEA-internal or on-prem endpoints.
Detects data-subject access requests in chatbot interactions, routes them to the official DSAR process and prevents the AI from making unauthorized data dumps.
Allows personal data in analytics and reporting projects to be processed only in pseudonymized form. If a raw identifier is detected, automatic redaction is applied.
Blocks processing of data of subjects under 16 (13-16 depending on member-state rule) without verified parental consent.
When bulk personal-data leakage or an abnormal data-access pattern is detected, opens a high-priority incident record and sends an instant notification to the CISO. For the 72-hour notification obligation, the incident timestamp and impact scope are reported automatically.
Automatically records all personal-data processing activities that occur through AI by category, purpose and project. Produces a structured report that feeds directly into the ROPA document.
Allows personal-data traffic only to model providers on the approved processor list with a signed DPA. Use of unapproved endpoints is blocked.
Produces an evidence pack documenting that personal-data policies are active by default (default-deny), that data does not leave the organization in on-prem deployments, and that all configuration changes are versioned. Feeds DPIA processes directly.