Data Protection Monitor
Global Privacy & Data Protection Intelligence

No domestic primary official source retrieved yet. None of the sources retrieved for this jurisdiction is the official instrument or regulator publication itself (tier 1). No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Curaçao Data Protection & Privacy Regulation

CW schema gdpri-v2 trajectory: not yet assessed in transition overlaps: Sentinel (AML/CFT), World Payments

Last updated · 10 categories · 24 claims · 14 sources in the cumulative register

Reports suggest the Curaçao Data Protection Board is not currently operational as the statutory supervisory authority under Ordinance No.

Data collected Data published

AI-assembled from cited sources

Not covered: Data Subject Rights, AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (2 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureIn transition7 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityData Protection Board (Curaçao) — provided for by statute but not yet establishedPrimary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence7 / 10 modules assessed0 Confirmed · 7 Probable · 0 Uncertain · 3 Not yet assessed

Jurisdiction brief

Latest update · 27 October 2026

Lead Signal

The Curacao Gaming Authority is understood to have discovered unauthorised access to its online licensing portal, with an access window running from December 2025 to September 2026, which exposed confidential beneficial-ownership and licensing data belonging to licensees under the LOK regime. The regulator has permanently discontinued the externally-managed portal, launched a temporary in-house replacement, commissioned an independent forensic investigation into the breach's impact and the system's weaknesses, and filed criminal complaints with authorities in Curacao, Germany and the Netherlands.

Key regulatory facts for Curaçao
Regulatory DimensionCuraçao Standing Position
JurisdictionCuraçao (CW)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 24 sourced findings)
Regulator & FrameworkA comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability.
Lawful Processing & Special DataCoverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available.
Data Subject RightsNo verified sub-module-level claims located for CW in this pass.
Controller/Processor DutiesTwo concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps.
Primary Instruments CitedDataGuidance, Curacao Chronicle, Curaçao Official Instrument (dlapiperdataprotection.com t-law-c-CW), Curacao Chronicle, Licentium
Last Confirmed / Updated2026-10-27 (14 sources in cumulative register)

#

A comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data (Landsverordening bescherming persoonsgegevens / Data Protection Ordinance)
Supervisory authorityData Protection Board (Curaçao) — provided for by statute but not yet established
Traffic-light rationale — AmberA comprehensive-looking statute exists and is in force, but the absence of an operational supervisory authority and of registration/notification machinery materially weakens practical enforceability.

Sub-modules (5)

Regulator And AuthorityRed

The Ordinance provides for a Data Protection Board to act as supervisory authority; as of this research pass, that Board has not yet been established, leaving the regime without an operational regulator.

Claims (2):

  • Data Protection Board (Curaçao) is reported to be not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. CHALLENGER FOLD (f-001, add_caveat/overstated_confidence): downgraded confidence Probable->Uncertain. Contradicting T4 sources (HBN Law & Tax 2023-02-02; LawGratis 2025-04-12; Neeyamo; Artemis Qualified eLearning) report the Board was established in January 2022 and remained at least nominally operational, with a 2023 government open-records reply indicating members subsequently resigned and seats went unfilled. Correct framing is 'established 2022, lapsed ~2023', not 'never established'.
  • College bescherming persoonsgegevens — Landsverordening bescherming persoonsgegevens Art. 41

Act And InstrumentsAmber

The operative instrument is Ordinance No. 84 of 4 September 2010, described by professional legal-research sources as modeled on the Dutch data-protection implementing act.

Claims (3):

  • Ordinance No. 84 of 4 September 2010 is reported to be modeled on the Dutch data-protection implementing act structure. Single-T2-source characterization; underlying Dutch-language statute text not independently parsed this cycle.
  • Curacao Council of Ministers — possible legislative approaches to implementing Council of Europe Convention 108+
  • Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84) — 2013-10-01

Material ScopeAmber

The Ordinance is reported to follow the structure of the Dutch implementing act (itself derived from the pre-GDPR EU data protection directive framework), covering automated and structured-file processing of personal data, but the precise scope articles were not independently retrieved in this pass.

Claims (1):

  • Ordinance No. 84 of 4 September 2010 covers automated and structured-file processing of personal data, per the pre-GDPR EU data protection directive-era structure inherited via the Dutch implementing act. Scope articles not independently retrieved; inference from secondary summary only.

Territorial ScopeRed

No CW-specific provision on extraterritorial application to non-established controllers was located in this research pass.

Regulator Registration And FilingAmber

The Ordinance does not set out requirements for data processing notifications to a supervisory authority.

Claims (2):

  • Ordinance No. 84 of 4 September 2010 does not set out requirements for data-processing notifications/filings to a supervisory authority. Negative finding (absence of registration/filing machinery) reported by DataGuidance.
  • National Ordinance Personal Data Protection (PB 2010 no. 84) — The Ordinance sets out no data-processing notification, DPO-appointment, or registration/filing requirement.
Category narrative 88 words

Curaçao's data protection regime rests on a single omnibus-style statute — Ordinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data — but the supervisory authority the Ordinance itself creates, the Data Protection Board, has never been stood up. This is the textbook 'statute enacted, DPA not operational' pattern: the law is in force, yet there is no functioning regulator to receive filings, hear complaints, or issue guidance. Registration/notification duties, DPO appointment duties and breach-notification duties are all absent from the text.

Periodic update · new data 2026-10-25

Regulator & Framework

Curacao's data-protection framework rests on the Landsverordening bescherming persoonsgegevens, a national ordinance in force since 1 October 2013, which designates the College bescherming persoonsgegevens as the supervisory body under its Article 41. No primary-source confirmation that this body is operationally independent and institutionalised as a dedicated data-protection authority has been identified, a gap that is directly relevant to the external criticism described below.

The principal development is procedural rather than legislative: Curacao's Council of Ministers received a presentation on 14 October 2026, prepared by an inter-ministerial working group, setting out possible legislative approaches to implementing Council of Europe Convention 108+ domestically. This is understood to be a preparatory step only. No bill text has been produced, and no firm timetable for any future legislation exists at this stage. The presentation should be read as evidence that the question of modernising Curacao's data-protection framework is now before the government at a decision-making level, not as evidence that reform has been enacted or is imminent on any confirmed date.

This development sits alongside, and plausibly responds to, the Dutch Data Protection Authority's public warning that Curacao's system for protecting personal data falls significantly short of international and EU-equivalent standards and lacks effective independent oversight. The timing, a formal warning from the Kingdom's own data-protection authority followed within months by a Council of Ministers presentation on Convention 108+ approaches, suggests at minimum that external pressure is a live input into Curacao's domestic legislative agenda, though the presentation itself does not confirm that any specific reform will follow or on what basis.

The practical effect of the developments is to leave the existing 2010/2013 ordinance as the operative law, unchanged, while formally opening a legislative-reform track whose outcome and timetable are both currently unknown.

Outlook

The next concrete marker will be whether the Council of Ministers' consideration of Convention 108+ approaches advances to an actual legislative proposal, and if so, on what timetable. Given the presentation is described as addressing possible approaches rather than a specific drafted instrument, a bill introduction in the near term should not be assumed. A second marker is whether any statement from Curacao's government directly addresses the Dutch AP's independence and oversight-capacity criticism, which the Convention 108+ presentation does not appear to have done directly.

1 earlier distinct update(s)
Periodic update · new data 2026-10-04

Regulator & Framework

Curacao's sole data-protection instrument is the National Ordinance Personal Data Protection (Landsverordening Bescherming Persoonsgegevens, PB 2010 no. 84), which entered into force in September 2010. The Ordinance is modelled on the Dutch GDPR-era implementing act and is closely aligned with its principles, including concepts such as a broad definition of personal data, but it is a wholly separate legal instrument from the EU General Data Protection Regulation and has not been updated to incorporate the GDPR's later-generation obligations, such as mandatory breach notification or data-protection-officer appointment.

The most significant finding concerning the framework's institutional structure is that the Data Protection Board, provided for under Article 42 of the Ordinance as the body intended to supervise compliance, is understood not to have been established as an operational independent supervisory authority. The date on which this institutional gap might be resolved, or whether the Board has ever been operational at any point since 2010, was not established this cycle. This leaves open a foundational question about how the Ordinance's substantive provisions, including lawful-processing requirements, security-measures duties, and data-subject access rights, are supervised and enforced in practice, independent of the content of those substantive rules themselves.

Separately, the Ordinance contains no data-processing notification, filing, or registration requirement of the kind found in many GDPR-adjacent regimes, meaning controllers operating in Curacao face no equivalent of a notification-to-regulator step before beginning processing activity. No more recent amending instrument to the Ordinance beyond its original 2010 enactment was located this cycle.

Outlook

Confirmation of whether and when the Data Protection Board has been or will be operationalised is the central open question for this module. Its resolution would clarify whether Curacao's data-protection framework currently operates with functioning independent supervision or principally as an unenforced statutory text pending institutional follow-through.

Sources and claims (8)
  1. Uncertain DataGuidance — Data Protection Board (Curaçao) is reported to be not currently operational as the statutory supervisory authority under Ordinance No. 84 of 2010. CHALLENGER FOLD (f-001, add_caveat/overstated_confidence): downgraded confidence Probable->Uncertain. Contradicting T4 sources (HBN Law & Tax 2023-02-02; LawGratis 2025-04-12; Neeyamo; Artemis Qualified eLearning) report the Board was established in January 2022 and remained at least nominally operational, with a 2023 government open-records reply indicating members subsequently resigned and seats went unfilled. Correct framing is 'established 2022, lapsed ~2023', not 'never established'. observed
  2. Probable DataGuidance — Ordinance No. 84 of 4 September 2010 is reported to be modeled on the Dutch data-protection implementing act structure. Single-T2-source characterization; underlying Dutch-language statute text not independently parsed this cycle. observed
  3. Uncertain DataGuidance — Ordinance No. 84 of 4 September 2010 covers automated and structured-file processing of personal data, per the pre-GDPR EU data protection directive-era structure inherited via the Dutch implementing act. Scope articles not independently retrieved; inference from secondary summary only. observed
  4. Probable DataGuidance — Ordinance No. 84 of 4 September 2010 does not set out requirements for data-processing notifications/filings to a supervisory authority. Negative finding (absence of registration/filing machinery) reported by DataGuidance. observed
  5. Probable Curacao Chronicle — Curacao Council of Ministers — possible legislative approaches to implementing Council of Europe Convention 108+ observed
  6. Probable DataGuidance — College bescherming persoonsgegevens — Landsverordening bescherming persoonsgegevens Art. 41 observed
  7. Probable DataGuidance — Landsverordening bescherming persoonsgegevens (A.B. 2010 no. 84) — 2013-10-01 observed
  8. Probable Curacao Chronicle — National Ordinance Personal Data Protection (PB 2010 no. 84) — The Ordinance sets out no data-processing notification, DPO-appointment, or registration/filing requirement. observed

#

Coverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Traffic-light rationale — RedCoverage gap: no verified sub-module-level detail located for this jurisdiction in this pass; only a general 'modeled on Dutch law' inference is available.
D2 · Lawful Processing — Full Module Record4 sub-modules · 65 words · 1 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

No verified sub-module-level claims located for CW in this pass.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Traffic-light rationale — Not assessedNo verified sub-module-level claims located for CW in this pass.

Sub-modules (5)

Access RightRed

Not independently verified for CW in this pass.

Rectification And ErasureRed

Not independently verified for CW in this pass.

Restriction And ObjectionRed

Not independently verified for CW in this pass.

Data PortabilityRed

Not independently verified for CW in this pass; the source statute predates the GDPR-era portability right by design lineage.

Deadlines And Response WindowsRed

Not independently verified for CW in this pass.

Category narrative 30 words

No Curaçao-specific detail on access, rectification/erasure, restriction/objection, portability, or statutory response deadlines was retrieved in this research pass; the underlying Ordinance text is Dutch-only and was not independently parsed article-by-article.

#

Two concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Supervisory authorityData Protection Board (Curaçao) — not yet established
Traffic-light rationale — AmberTwo concrete, confirmed negative findings (no DPO duty, no breach-notification duty) are informative but the remaining sub-modules are unverified gaps.
Periodic update · new data 2026-10-18

Controller/Processor Duties

The standing statutory duty on controllers, termed responsible parties under the 2010 National Ordinance Personal Data Protection, is set out at Article 13: a responsible party must execute appropriate technical and organizational measures to secure personal data against loss or any form of unlawful processing, with the level of security guaranteed calibrated to the state of the art, cost of execution, and the risks associated with the processing. This duty is confirmed and unchanged this cycle. What is new, and material, is what appears absent around it. The breach of the Curacao Gaming Authority's online licensing portal, confirmed by the CGA on 7 October 2026, exposed approximately 40,000 documents covering beneficial-ownership and identification data for nearly 650 licensed companies. No statutory breach-notification duty to a regulator or to affected data subjects, of the kind found in GDPR Articles 33 and 34, has been located under the 2010 Ordinance, and no response from the Personal Data Protection Committee to this breach has been identified. These two findings together describe a controller-duties landscape with a security-measures obligation on paper but no confirmed notification mechanism or regulatory follow-through observed in this specific instance.

Outlook

Whether the Personal Data Protection Committee responds to the CGA breach, and whether any notification duty is identified on fuller review of the Ordinance's primary text, are the two open questions carried forward from this cycle.

D4 · Controller & Processor — Full Module Record7 sub-modules · 30 words · 5 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

The core adequacy-based transfer restriction is confirmed and binding; downstream transfer-mechanism detail (SCCs, BCRs, TIA, localisation) is an unverified gap.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Supervisory authorityData Protection Board (Curaçao) — not yet established
Traffic-light rationale — AmberThe core adequacy-based transfer restriction is confirmed and binding; downstream transfer-mechanism detail (SCCs, BCRs, TIA, localisation) is an unverified gap.
D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 44 words · 3 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

One confirmed financial-sector/AML-adjacent finding; remaining sectoral sub-modules are unverified gaps.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Traffic-light rationale — AmberOne confirmed financial-sector/AML-adjacent finding; remaining sectoral sub-modules are unverified gaps.
D6 · Sectoral Watch — Full Module Record7 sub-modules · 52 words · 1 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No sub-module findings located; comprehensive gap for this module in this jurisdiction.

Traffic-light rationale — Not assessedNo sub-module findings located; comprehensive gap for this module in this jurisdiction.

Sub-modules (6)

Cookies And TrackersRed

No CW-specific cookie/tracker regime located.

Dark PatternsRed

No CW-specific dark-pattern prohibition located.

Opt Out SignalsRed

No CW-specific opt-out signal recognition (e.g., GPC) located.

Clean Rooms And DcrRed

No CW-specific clean-room/data-collaboration rules located.

Cross Context AdvertisingRed

No CW-specific cross-context-advertising ('sale'/'share') rule located.

Direct MarketingRed

No CW-specific direct-marketing consent/suppression rule located.

Category narrative 23 words

No Curaçao-specific cookie/tracker consent regime, dark-pattern prohibition, opt-out-signal recognition, clean-room rules, cross-context-advertising rules, or direct-marketing consent/suppression rules were located in this research pass.

#

No sub-module findings located; comprehensive gap for this module in this jurisdiction.

Traffic-light rationale — RedNo sub-module findings located; comprehensive gap for this module in this jurisdiction.
D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 16 words · 1 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

No sub-module findings located; comprehensive gap for this module in this jurisdiction.

Traffic-light rationale — Not assessedNo sub-module findings located; comprehensive gap for this module in this jurisdiction.

Sub-modules (5)

Age VerificationRed

No CW-specific age-verification rule located.

Minor Profiling BansRed

No CW-specific minor-profiling ban located.

Education SettingsRed

No CW-specific education-setting DP rule located.

Dependent AdultsRed

No CW-specific dependent-adult protection rule located.

Category narrative 18 words

No Curaçao-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in this research pass.

#

No operational regulator and no confirmed enforcement track record under the Ordinance.

Primary frameworkOrdinance No. 84 of 4 September 2010 Laying Down Rules on the Protection of Personal Data
Supervisory authorityData Protection Board (Curaçao) — not yet established
Traffic-light rationale — RedNo operational regulator and no confirmed enforcement track record under the Ordinance.
Periodic update · new data 2026-10-25

Enforcement & Redress

Curacao's data-protection ordinance provides for administrative fines of up to NAf./Cg 10,000 under Article 54, alongside a criminal offence carrying up to six months imprisonment for intentional breach under Article 63. These penalty levels are unchanged and represent the standing enforcement architecture under the 2010/2013 statute.

The more significant development in this domain is not a change to the penalty provisions themselves but the Dutch Data Protection Authority's explicit characterisation of Curacao's oversight capacity as lacking. The Dutch AP has warned that Curacao's system for protecting personal data falls significantly short of international and EU-equivalent standards and lacks effective independent oversight. Read against the modest administrative-fine ceiling and the absence of any confirmed general breach-notification duty, this criticism suggests the enforcement and redress architecture available under the current ordinance may be under-resourced relative to the scale and sensitivity of personal data now processed in and through Curacao, though no primary-source information on actual enforcement activity, case volumes, or the supervisory body's budget or staffing has been identified to confirm this directly.

This criticism arrives in the same period as a separate, though unconnected within this domain, demonstration of oversight-capacity strain: a prolonged unauthorised-access incident at a Curacao sector regulator's licensing system. While that incident falls outside this module's scope and is addressed elsewhere, its timing lends some concrete texture to the Dutch AP's otherwise general warning about oversight adequacy.

Outlook

The principal marker to watch is whether Curacao's government responds formally to the Dutch AP's criticism, whether through the Convention 108+ legislative track or through some other confirmation of the College bescherming persoonsgegevens' resourcing and independence. Absent such a response, the existing fine and criminal-penalty framework, together with an unconfirmed supervisory-independence status, remains the operative enforcement picture.

Periodic update · new data 2026-10-18

Enforcement & Redress

The most significant data-protection-relevant development of the past 180 days for Curacao is the absence of an enforcement or redress response, not its presence. The Personal Data Protection Committee, Curacao's designated data-protection authority under Article 42 of the 2010 National Ordinance Personal Data Protection, has not been identified as having issued any statement, opened any investigation, or taken any enforcement step in response to the Curacao Gaming Authority's licensing-portal breach, which exposed roughly 40,000 documents including ownership and identity data for nearly 650 licensed companies. Separately, as of the most recent available legal guide reviewed, no local key decisions applying the Personal Data Protection Ordinance were known to the contributing firm, a finding that reflects the absence of a known enforcement record as of that source's publication date rather than a confirmed current-state absence. Taken together, these findings reinforce a standing concern that Curacao's data-protection regulator has not demonstrated confirmed independent institutional enforcement capacity, a concern now sharpened by its apparent non-engagement with a breach of significant scale.

Outlook

The item to watch is whether the Personal Data Protection Committee breaks its apparent silence on the CGA breach. Continued non-engagement would further reinforce the standing capacity concern; any public statement or investigation would be the first identified enforcement-adjacent activity from the Committee in the material reviewed.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 84 words · 5 traced claims · Re-verified 2026-10-27

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 24 claim(s) (24 category placement(s)), 14 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 3 Nov 2026: upheld (7 confirmed against the cited source; 16 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 13-22Data Subject Rightsaccess right
Art. 32-34Controller/Processor Dutiessecurity measures
Art. 37-39Controller/Processor Dutiesdpo requirements
Art. 44-49Cross-Border & Adequacytransfer mechanisms
Art. 77-84Enforcement & Redressregulator powers and penalties