Release v4.107.0

Summary

Models can now declare why they process personal data: processing purposes with their lawful basis, retention, recipients and transfers, referenced from the parts of the model that process it, and a record of processing (GDPR Art. 30) generated from those declarations. Concepts, policies, constraints, projections, screens and forms can also carry a description.

Added

• purpose <Name> declarations with basis (GDPR Art. 6(1)), interest, condition (Art. 9(2)), authorization (Art. 10), subjects, retention, recipient, transfer … safeguard and erasure exception (Art. 17(3)), referenced with purpose <Name> from modules, features and slices; they are report-only and do not change the executable model (part of #557)
• The opt-in check --check purposes asks about personal data with no purpose in scope, special-category data without an Art. 9(2) condition, criminal-offence data without an authorization, purposes without a lawful basis and purposes nothing references (part of #557)
• A record of processing activities generated from the model, through the MCP processing-record tool and screenplay report processing --format json|markdown|csv, with a DPIA prompt and a finding when erasing a data subject would also destroy data kept under a legal obligation; it is generated from declarations and is not legal advice (#557)
• description "…" on concepts, policies, constraints, projections, screens and forms (#535)
• The concepts guide explains each GDPR special category (pii special …) and criminal-offence data (pii criminal), with links to the regulation, and the editors show the same explanation on hover (part of #557)