BY NEURABYTE
FRAMEWORKS/PRIVACY/GDPR
GDPR
PRIVACY · European Union

GDPR

Personal data rules that follow EU residents wherever their data goes.

The General Data Protection Regulation governs processing of personal data of people in the EU. It requires a lawful basis, data minimization, purpose limitation, and honoring rights including access and erasure. Fines reach 4% of global turnover. There is no certification of general compliance, though Art. 42 certifications exist for specific processing.

AT A GLANCE
ISSUEREuropean Union REGIONEU and EEA, extraterritorial CATEGORYPrivacy CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Any organization processing personal data of EU or EEA residents
02AI systems that ingest, remember, or act on personal data
03Processors handling data on behalf of controllers
02. KEY REQUIREMENTS

The parts of GDPR that touch what agents do.

Art. 5(1)(c) Data minimization
Personal data is adequate, relevant, and limited to what is necessary.
Art. 17 Right to erasure
Personal data is erased without undue delay on request, and erasure can be demonstrated.
Art. 30 Records of processing
Controllers and processors maintain records of processing activities.
Art. 32 Security of processing
Appropriate technical measures, including the ability to ensure confidentiality and integrity.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against GDPR. Where there is no evidence, the report says gap.

LORE CONTROL GDPR REFERENCE
Context disclosure recordArt. 5(1)(c), Art. 30
Provable deletionArt. 17
Signed, hash-chained receiptsArt. 5(2), Art. 32
Blocking authorization gateArt. 32(1)(b)
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Lawful basis, DPIAs, and data processing agreements are legal determinations.
Data subject request intake and identity verification happen in your systems.
05. QUESTIONS
Does erasing memory satisfy Art. 17?
Provable deletion destroys the per-unit key and issues a receipt of what was destroyed. That covers Lore's copy. Copies elsewhere in your stack are your responsibility.
What about model training?
Lore does not train models. The disclosure record shows exactly what was sent to which model and when, which supports minimization reviews.
Is Lore a controller or processor?
Processor, in the usual deployment. Self-hosted deployments keep all data in your environment.
← PREVIOUSNIS 2 ALL FRAMEWORKS NEXT →HIPAA
GDPR · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for GDPR tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.