Frameworks · Laws and regulations

qodiqa and the GDPR

qodiqa checks each AI request before the call and keeps tamper-evident, offline-verifiable evidence. This page shows where that evidence supports the GDPR, and where it does not.

Law
European Union
Applies since 25 May 2018.
Verified 2026-11-01

Read the official text Back to all frameworks

Overview

What it is

Issuer: European Union
Type: Law
Status: Applies since 25 May 2018
Official text: eur-lex.europa.eu

Regulation (EU) 2016/679, the General Data Protection Regulation. The GDPR governs the processing of personal data in the EU. For AI it matters most through accountability (Art. 5(2)), data protection by design and default (Art. 25), records of processing (Art. 30), security (Art. 32) and the rules on decisions based solely on automated processing (Art. 22).

Who it applies to. Controllers and processors that process personal data of people in the EU, wherever they are established. qodiqa describes itself as a processor-side technical control, and the controller’s duties stay with you.

Where it meets qodiqa

The parts of the GDPR where the evidence matters.

Accountability

Verifiable evidence of each decision supports the ability to demonstrate (Art. 5(2)).

Human oversight

Bound approvals and a decision record give a starting point for the safeguards in Art. 22(3).

Record-keeping and logging

Consent, purpose and audit fields can feed a record of processing.

Robustness and security

Encryption, key separation and access control support Art. 32.

Traceability

A consent check on each request shows the basis at the time of processing.

Risk management

Blocked-request counts by reason are an input to a data protection impact assessment, which stays yours.

Mapping

What qodiqa provides, and what stays with you.

Requirement or control	What qodiqa provides	What stays with you
`Art. 5(2)` Accountability: the controller must be able to demonstrate compliance with the processing principles.	Verifiable evidence of what the gateway checked and decided for each request: signed receipts, hash-chained audit entries and Merkle proofs.	The processing principles themselves, and your overall accountability programme.
`Art. 22(1)–(3)` Decisions based solely on automated processing with legal or similarly significant effects: safeguards include human intervention and the ability to contest.	Bound human approval for irreversible tool actions, and a record of each automated decision that can be produced when a decision is contested.	Deciding whether Art. 22 applies, the legal basis, and giving people intervention, a hearing and a way to contest.
`Art. 25(1)–(2)` Data protection by design and by default.	Default-deny posture: no consent artifact, no processing. Consent is checked on every request and revocation blocks the next one. Retention is configurable per data category.	Minimising the data sent to the model, and the design of your whole processing.
`Art. 30(1)–(2)` Records of processing activities, kept by controllers and by processors.	Consent records carry a scope and a lawful basis, and audit entries record each request, so both can feed a record of processing.	The record itself: controller details, categories of data and recipients, transfers and time limits for erasure.
`Art. 32(1)` Security of processing: pseudonymisation and encryption, ongoing confidentiality, integrity and availability, regular testing.	Ed25519 signatures, encrypted keys at rest, separate key domains, role-based access, and documented key rotation and backup procedures.	Security of the rest of your systems, and testing programmes.
`Art. 6(1)(a) and Art. 7` Consent as a lawful basis and its conditions, including withdrawal.	A consent record per actor and purpose, a check on every request and blocking after revocation.	Whether consent is freely given, specific and informed (a legal question), and how withdrawal is offered to people.
`Art. 33 and Art. 35` Breach notification and data protection impact assessment.	Audit and alert records that help reconstruct an event and support a DPIA.	Notifying a supervisory authority, and the impact assessment.

Cross-check: the Regulatory Alignment Matrix, section 3

How it fits

What the GDPR asks, and what qodiqa produces.

Accountability (Art. 5(2)) is supported by Receipts and audit entries (Verifiable by a third party).
Automated decisions (Art. 22(3)) is supported by Bound approval and decision record (A record to contest against).
By design and default (Art. 25) is supported by Default-deny consent checks (Revocation blocks the next call).

Evidence

Evidence you can hand to an auditor.

Five artifacts, each checkable on its own

Consent artifact Signed with Ed25519, bound to one request, single use.
INTENT entry The audit entry written before the provider call.
Receipt A signed decision record that checks offline.
Audit export Hash-chained entries with a Merkle inclusion proof.
Anchor proof A signed checkpoint pinned outside the gateway.

Verify offline, from a clone of qodiqa-verify

node bin/verify.bundle.external.js \
  --keys examples/front-half/keys.json \
  --transparency-keys examples/front-half/transparency-keys.json \
  examples/front-half/bundle-with-proof.json

The example files ship with the repository and are signed with throwaway keys. The command exits 0 and prints "valid": true. For your own evidence, take keys and anchors from a source other than the gateway that wrote it.

Scope and limits

Technical evidence, not a compliance outcome

qodiqa produces verifiable technical evidence that supports parts of the GDPR. It is not a compliance certification, it is not legal advice, and no regulator or standards body has endorsed it. Whether your use meets the GDPR is a decision for you and your advisers.

What qodiqa does not address:

Lawful basis, purpose limitation and the notices you give data subjects.
Erasure: revoking consent is not erasing data, and Art. 17 is not mapped here.
Data protection impact assessments, records of processing and breach-notification decisions.
Only requests that pass through the gateway are checked, and a receipt proves a decision was recorded, not that it was correct.

Sources

Article, clause and control references were read in the official texts listed first. The remaining links are qodiqa’s own documents. Checked on 2026-11-01; rules change, so read the current text.

Regulation (EU) 2016/679 (GDPR), EUR-Lex accessed 2026-11-01
qodiqa specification: Regulatory Alignment Matrix (QODIQA-RAM-2026-001) accessed 2026-11-01
qodiqa-gateway: data-subject rights framework accessed 2026-11-01
qodiqa-gateway: data governance (minimisation, retention) accessed 2026-11-01
qodiqa-gateway: limitations accessed 2026-11-01

Next steps

See the evidence for yourself.

Read the spec section Run a simulation Quickstart