← Supported standards

GDPR

European Union · General Data Protection Regulation SIGNET support: Compliance enablement — consent and purpose as data

What it is

The General Data Protection Regulation is the EU's data-protection law, governing how personal data is collected, processed, and shared. Its core principles — lawful basis, purpose limitation, data minimisation, storage limitation, and accountability — apply to any organisation handling the personal data of people in the EU, with procurement data (contacts, signatories, evaluators) squarely in scope.

The regulation's official text is published by the EU. Official reference →

How SIGNET supports it

GDPR sits in SIGNET's compliance enablement tier. Compliance is an obligation of the organisations processing data, not a property a standard can confer — but SIGNET's data-sovereignty architecture expresses several of the regulation's principles as structure rather than policy documents.

Purpose limitation and storage limitation have a direct structural counterpart: the canonical Consent object records the right of a named party, for a stated purpose, for a bounded time, to access data held by another party. Access is granted as data, scoped as data, and expires as data. Data minimisation is served by the model's separation of assertion from access — a Document reference and its accessGrant are distinct, so parties learn that something exists without automatically receiving its contents, and selective-disclosure credentials let a party prove an attribute without revealing the record behind it. And accountability is native: who accessed what, under which grant, and who decided what, under which authority, are append-only records with provenance.

No central data warehouse is assumed anywhere in the model — data stays with its controller, and grants travel instead of copies.

Where it lives in the standard