How the Data Protection Monitor Works

An honest starting point

The Data Protection Monitor did not start life as a public website. It was built and run for over a year as a producer — a structured, source-cited data feed consumed by other Ramparts regulatory-intelligence monitors, with no reader-facing surface of its own. This public front end is new. The Renderer and Publisher pipeline stages that turn producer output into a published page did not exist before this build; the site now carries 155 published jurisdiction pages, counted at build time. Where this site has no content to show, it says so plainly — "pipeline onboarding in progress," "not yet populated," "coming soon" — rather than fabricating a count, a finding, or a status.

Pipeline stages

The Data Protection Monitor's producer pipeline runs five stages. The first four are the established producer path; the fifth and sixth are new, added specifically to support this public front end.

The producer→consumer contract that other Ramparts monitors depend on is unchanged by adding a front end — the Data Protection Monitor's producer role is unaffected; the Renderer/Publisher stages read from the same Applier output without altering it.

The ten-module grammar

Every jurisdiction the Data Protection Monitor covers is analysed against the same ten parent modules, so jurisdictions are comparable to each other:

Each parent module decomposes into sub-modules under the Data Protection Monitor's internal doctrine (57 in total across the ten parents). The per-jurisdiction template page uses these same ten module names as its section headings, so the site's structure matches the pipeline's own taxonomy rather than a separately invented one.

Free-jurisdiction policy

Seven jurisdictions are available on the free tier without a subscription: the European Union, United States, and Canada (each scoped to the federal/supranational level only — member-state, state, or provincial jurisdictions within them are gated separately), plus China, Nigeria, the United Kingdom, and Gibraltar at national scope. This allowlist is declared in the Data Protection Monitor's own consumer.config.json and is shared byte-for-byte with the equivalent crypto regulatory consumer in the same fleet, so a reader who knows one free-tier list knows the other.

Scope and current status

The Data Protection Monitor tracks 155 jurisdictions in its registry. 155 of them have a published jurisdiction page. Both figures are counted from the registry and the published pages at build time, not typed in; the jurisdiction template shows the page shape, including the explicit honest-empty state a module carries where the pipeline has produced nothing.

Pipeline disclosure: how this content is produced

The Data Protection Monitor's claims are assembled by an AI research pipeline from cited public sources. The content: ai_generated mark means the analysis beside it was assembled by that pipeline, and it is general information, not legal advice. Facts are machine-assembled from cited public sources. Individual claims have not each been independently verified by a human reviewer. The pipeline roles are DR, Interpreter, Composer and Applier, run in that order after the registry. Where the pipeline has produced nothing, the page says so rather than substituting a generic disclaimer or a plausible estimate.

• Silence when nothing material. A module or jurisdiction with no findings is shown as an explicit empty state, never filled with invented content.
• No fabricated counts. A count or date is shown only where pipeline data backs it; the jurisdiction and module figures on this site are counted at build time from the registry and the published pages.
• Cited provenance. Structural values such as module lists, jurisdiction lists and pipeline role names come from this site's own configuration and the fleet doctrine, not invented for the page.