Class GdprRules

java.lang.Object

com.cloudforgeci.api.core.rules.GdprRules

All Implemented Interfaces:

FrameworkRules<SystemContext>

@ComplianceFramework(value="GDPR",
                     priority=30,
                     displayName="GDPR",
                     description="Validates GDPR technical safeguards for personal data protection")
public class GdprRules
extends Object
implements FrameworkRules<SystemContext>

GDPR (General Data Protection Regulation) compliance validation. GDPR (EU) 2016/679 requires technical and organizational measures to protect personal data. This validator focuses on technical measures that can be implemented at the infrastructure level. GDPR Technical Requirements Coverage: - Article 25: Data Protection by Design and by Default - Article 30: Records of Processing Activities - Article 32: Security of Processing - Article 33: Notification of Personal Data Breach - Article 35: Data Protection Impact Assessment Note: GDPR includes many organizational and legal requirements (consent, data subject rights, privacy policies) that must be implemented at the application and business process level. This validator covers infrastructure-level technical safeguards only.

Constructor Summary

Constructors

Constructor	Description
GdprRules()

Method Summary

Modifier and Type	Method	Description
Set<String>	claimedControls()	Controls checked across every validate* method above -- see FrameworkRules.claimedControls().
String	generateComplianceReport(SystemContext ctx)	Generate GDPR technical safeguards compliance report.
void	install(SystemContext ctx)	Install GDPR compliance validation rules.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface FrameworkRules

alwaysLoad, description, displayName, frameworkId, getRequiredConfiguration, priority

Constructor Details

GdprRules

public GdprRules()

Method Details

install

public void install(SystemContext ctx)

Install GDPR compliance validation rules. GDPR applies when processing personal data of EU residents. Only enforced for PRODUCTION and STAGING environments.

Specified by:

install in interface FrameworkRules<SystemContext>

Parameters:

ctx - the system context containing deployment configuration and CDK stack

Since:

3.0.0

claimedControls

public Set<String> claimedControls()

Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). GuardDuty is read in validateBreachDetection(SystemContext), now producing an advisory finding (not just a pass) when off, since it's ADVISORY for GDPR per ComplianceMatrix. HTTPS_STRICT and SECURITY_HUB are ADVISORY for GDPR per the matrix and unchecked in this class. LAMBDA_SECURITY and DATABASE_ACCESS_CONTROL are genuine gaps -- no class anywhere checks them.

Specified by:

claimedControls in interface FrameworkRules<SystemContext>

Returns:

the control identifiers this framework's install() validates; empty if undeclared

generateComplianceReport

public String generateComplianceReport(SystemContext ctx)

Generate GDPR technical safeguards compliance report.