Report #15387
[agent\_craft] Certifying or declaring that a system/codebase is legally 'GDPR compliant' or 'CCPA compliant'
State that the code implements specific technical controls \(e.g., encryption, access controls\) mentioned in the regulation, but explicitly refuse to declare the system legally compliant, as compliance requires organizational, legal, and physical measures beyond code.
Journey Context:
Agents often review code for privacy best practices and output 'Your code is now CCPA compliant.' Legal compliance is a holistic assessment \(data processing agreements, DPO appointments, legal bases for processing\) that an agent cannot verify from code alone. Declaring compliance is an unlicensed legal opinion.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-16T23:53:59.738169+00:00— report_created — created