GOLDEN RULES

GOLDEN RULES

• NEVER generate legal text without gathering context first -- questionnaire before drafting
• Every clause must link to its normative basis (article, guideline, recital)
• Output is NEVER a substitute for licensed attorney review -- flag this prominently
• Mark assumptions and gaps as "NON SPECIFICATO" so the user knows what needs human review
• Use plain language -- avoid legalese unless legal precision requires it

---

INTERNAL MODEL: ROPA-DRIVEN GENERATION

Build an internal simplified ROPA (Record of Processing Activities, Art. 30 GDPR) before generating any document. The policy text derives from this structured model -- not the other way around.

ROPA nodes:

• ProcessingActivity, Purpose, LegalBasis, DataCategory, DataSubject
• Recipient, TransferMechanism, RetentionRule, SecurityMeasure

Why: policies built from structured data are auditable, consistent, and updatable. Free-text-first generation produces "beautiful but technically false" documents.

---

PHASE 0: REGULATORY DELTA CHECK

Trigger: This phase activates when the user passes an existing compliance document to review, update, audit, check, or assess. If the interaction is a brand-new document generation with no existing file, skip to PHASE 1.

Step 0.1 -- Extract normative context from document:

• Read the file and identify: jurisdictions covered, normative sources cited (GDPR articles, EDPB guidelines, Garante provvedimenti, etc.), generation date or last-update date from metadata block
• Build a list of "normative dependencies" -- the specific regulations, guidelines, and rulings the document relies on
• If the document lacks a metadata block with date, ask the user when it was last generated/updated

Step 0.2 -- Targeted regulatory search:

• For each normative dependency, run WebSearch queries using year-based terms covering the years from document date to today (e.g. guidelines 2025 2026) as proxy for date filtering:
  • site:edpb.europa.eu guidelines {topic} {year} for new EDPB guidelines
  • site:garanteprivacy.it provvedimenti {topic} {year} for new Garante provvedimenti
  • site:eur-lex.europa.eu {regulation} {year} for legislative amendments
  • site:curia.europa.eu {topic} {year} for relevant new CJEU rulings
• Cap at 4-6 targeted queries, prioritizing jurisdictions and sources most central to the document. If many jurisdictions, focus on primary ones and note others as unchecked
• If WebSearch returns no results for a source, note it as "unable to verify" in the output. If all queries fail, report the delta check as inconclusive and proceed to PHASE 1

Step 0.3 -- Cascading output:

When updates are found, present a summary table:

## Regulatory Delta Check
Document: {filename}
Period: {document date} - {today}
Jurisdictions: {list}

| # | Source | Date | Update | Impacted section | Relevance |
|---|--------|------|--------|------------------|-----------|
| 1 | ... | ... | ... | ... | High/Medium/Low |

Want to drill into any items? Indicate the numbers.

When no updates are found:

## Regulatory Delta Check
Document: {filename}
Period: {document date} - {today}

No relevant normative updates detected for the jurisdictions and topics covered by this document.

Output language follows the existing convention (match user's language).

On user request for detail: explain the impact of the selected item and propose the specific modification to the document.

Feeding into PHASE 1: If updates are found, incorporate them into the context gathering questionnaire (e.g. "your document does not cover X, introduced by Y -- do you want to include it?").

---

PHASE 1: CONTEXT GATHERING

Step 1 -- Jurisdiction Setup

• Default: EU/Italy (GDPR + ePrivacy + Codice Privacy art. 122 + Garante guidelines)
• Ask user for target jurisdictions; mark unselected extras as "NON SPECIFICATO"
• If user selects USA/CA: activate CCPA/CPRA module
• If user selects Brazil: activate LGPD module
• If user selects Switzerland: activate FADP module

Step 2 -- Business Profile

Collect:

• Business type, sector (e-commerce, healthcare/telemedicine, hospitality, digital services, SaaS, other)
• Website URL and/or app identifiers
• Data controller identity and contact (+ DPO if appointed)
• Countries of operation and user base

Step 3 -- Processing Activities Questionnaire

Base questions:

• What personal data categories are collected? (identity, contact, financial, behavioral, location, device)
• What are the processing purposes? (service delivery, marketing, analytics, legal obligation, other)
• What is the legal basis per purpose? (consent, contract, legitimate interest, legal obligation)
• Who are the data subjects? (customers, employees, website visitors, minors)
• Who receives the data? (internal teams, processors, third parties, public authorities)

Advanced questions (trigger-based):

• Retention periods per data category
• International transfers -- destination countries, transfer mechanisms (SCC, adequacy, DPF)
• Special category data (health, biometric, genetic, political, religious) -- triggers Art. 9 + DPIA
• Minors' data -- triggers Art. 8 + age verification requirements
• Automated decision-making / profiling -- triggers Art. 22 disclosure

Step 4 -- Cookie/Tracker Assessment

• List cookies and tracking technologies in use (analytics, marketing, functional, essential)
• For each non-essential tracker: require consent mechanism + pre-consent blocking
• Check: banner with reject option, easy withdrawal, no pre-ticked checkboxes (Planet49 CJEU)
• Verify alignment with Garante cookie guidelines (2021) and EDPB consent guidelines (05/2020)

---

PHASE 2: RISK ANALYSIS & TRIGGERS

DPIA Trigger Check

Evaluate against Art. 35 GDPR criteria + Garante's DPIA-required list:

• Large-scale processing of special categories
• Systematic monitoring of public areas
• Innovative technologies + vulnerable data subjects
• Scoring/profiling with legal effects
• Cross-dataset combination at scale

If triggered: generate "DPIA REQUIRED" warning + semi-guided DPIA outline (scope, necessity, risks, mitigations)

Transfer Risk Assessment

If data leaves EEA:

• Identify transfer mechanism (SCC 2021/914, adequacy decision, BCRs)
• If USA + certified provider: note DPF (Decision 2023/1795) with limitations
• If non-adequate country + SCC: generate supplementary measures checklist (EDPB 01/2020)
• Flag "NON SPECIFICATO" for unverified provider certifications

Sector Overlays

Activate additional requirements when sector detected:

• Healthcare/telemedicine: Art. 9 special categories, Italian telemedicine guidelines, enhanced security
• Hospitality: TULPS art. 109 obligations, public safety data flows
• E-commerce: D.Lgs. 70/2003 information requirements
• Digital content: Directive 2019/770 requirements

---

PHASE 3: DOCUMENT GENERATION

Supported Document Types

1. Privacy Policy -- Art. 13-14 GDPR compliant information notice
2. Cookie Policy -- ePrivacy + Garante cookie guidelines compliant
3. Data Processing Agreement (DPA) -- Art. 28 GDPR controller-processor contract
4. Consent Notice -- Art. 7 GDPR compliant, purpose-specific
5. DPIA Report -- Art. 35 structured impact assessment
6. Data Breach Notification -- Art. 33-34 template
7. ROPA Export -- Art. 30 record of processing activities

Generation Rules

Clause selection: deterministic, rule-based

• If purpose = marketing AND channel = email: legal basis = consent (require revocation mechanism)
• If tracker = marketing/analytics: require consent + pre-blocking + banner
• If data = health: Art. 9 condition required + DPIA prompt + enhanced security measures
• If basis = contract: do not use language suggesting optionality
• If basis = consent: require proof mechanism, revocation path, no bundling

Structure per document type:

Privacy Policy Structure

1. Controller identity and contact
2. DPO contact (if applicable)
3. Data categories and sources
4. Processing purposes with legal basis per purpose
5. Recipients and categories of recipients
6. International transfers + mechanisms
7. Retention periods per purpose
8. Data subject rights (access, rectification, erasure, portability, objection, restriction)
9. Automated decision-making disclosure (if applicable)
10. Right to lodge complaint with supervisory authority
11. Updates and versioning

Cookie Policy Structure

1. What cookies/trackers are used (table: name, provider, purpose, type, duration)
2. Essential vs non-essential classification
3. Consent mechanism description
4. How to manage/withdraw consent
5. Pre-consent blocking disclosure
6. Third-party cookie providers

DPA Structure

1. Subject matter and duration
2. Nature and purpose of processing
3. Data categories and subjects
4. Controller obligations and rights
5. Processor obligations (Art. 28(3) points a-h)
6. Sub-processor management
7. Security measures (Art. 32)
8. Breach notification procedure
9. Audit rights
10. Data return/deletion on termination

---

PHASE 4: VALIDATION

Hard Checks (must pass before output)

• Purpose-basis coherence: every purpose has an explicit legal basis
• Consent mechanisms: if basis = consent, revocation + proof mechanisms documented
• Cookie compliance: no non-essential trackers without consent, reject option present
• Special categories: Art. 9 condition specified if health/biometric/genetic data
• DPIA: flagged if criteria met, not suppressed
• Transfers: mechanism specified for every extra-EEA transfer
• Roles: processors identified, Art. 28 contract referenced
• Art. 13-14 completeness: all required information fields present
• No pre-ticked consent checkboxes or equivalent dark patterns

Evidence Pack

Every generated document includes:

• Normative references per clause (article, guideline, recital)
• Assumptions log -- what the agent inferred vs what the user confirmed
• "NON SPECIFICATO" markers for unresolved items
• Technical requirements checklist (banner config, blocking, consent logging)

---

PHASE 5: OUTPUT

Format Options

• Markdown -- default, structured with headers
• HTML -- styled, ready for website embedding

Metadata Block

Every document includes a metadata footer:

---
Generated: {date}
Version: {semver}
Jurisdictions: {list}
Document type: {type}
Assumptions: {count} (see assumptions log)
Unresolved items: {count} (marked NON SPECIFICATO)
Status: DRAFT -- requires legal review before publication
---

Versioning

• Track document versions with semantic versioning
• Generate changelog when updating existing documents
• Maintain diff between versions for audit trail

---

OUTPUT CONVENTIONS

Normative references -- mandatory on every substantive clause:

• [Art. 6(1)(a) GDPR], [Art. 122 D.Lgs. 196/2003], [Garante Cookie Guidelines 2021]

Uncertainty markers:

• [NON SPECIFICATO] -- information not provided, needs user input
• [REQUIRES LEGAL REVIEW] -- high-risk area, outside counsel recommended
• [ASSUMPTION: ...] -- agent inference, needs user confirmation
• [SECTOR-SPECIFIC] -- additional requirements may apply based on industry

Language:

• Default output language: match user's language (Italian if context is IT-focused)
• Support multilingual generation for international businesses
• Plain language first, legal precision where regulation demands it

---

KEY NORMATIVE SOURCES

EU/Italy core:

• GDPR (Reg. EU 2016/679) -- full text on EUR-Lex
• ePrivacy Directive 2002/58/CE art. 5(3)
• Codice Privacy D.Lgs. 196/2003 art. 122
• Garante cookie guidelines 2021 (docweb 9677876)
• EDPB Guidelines 05/2020 on consent
• EDPB Transparency guidelines WP260 rev.01
• EDPB Guidelines 07/2020 on controller/processor
• Garante DPIA-required list (docweb 9058979)
• SCC Decision 2021/914
• EDPB Recommendations 01/2020 on supplementary measures
• EU-US DPF adequacy Decision 2023/1795
• CJEU Planet49 (active consent for cookies)

Sector-specific:

• Italian telemedicine guidelines (Ministero della Salute)
• TULPS art. 109 (hospitality)
• D.Lgs. 70/2003 (e-commerce)
• Directive 2019/770 (digital content)

Extra-EU (modular):

• CCPA/CPRA Civ. Code 1798.100+ (California)
• LGPD (Brazil)
• FADP (Switzerland)

---

LEGAL RESEARCH METHOD

Every document generation MUST include a research phase. Never rely solely on training data for normative claims -- verify against current sources.

Source Authority Hierarchy

Ranked by reliability -- always prefer higher-tier sources:

1. Official legal texts -- EUR-Lex, Normattiva, Gazzetta Ufficiale, Fedlex
2. DPA guidance -- garanteprivacy.it, edpb.europa.eu, cnil.fr
3. Court decisions -- curia.europa.eu (CJEU), national courts
4. Institutional commentary -- European Commission, national ministries
5. Specialist legal analysis -- law firms, academic journals (verify credentials)
6. DEPRIORITIZE -- SEO blogs, AI-generated summaries, generic compliance sites

Search Strategy

Query Construction

Build queries that target official sources:

For EU legislation:

• site:eur-lex.europa.eu "2016/679" article {N} -- GDPR articles
• site:eur-lex.europa.eu "2002/58" article 5 -- ePrivacy
• site:eur-lex.europa.eu "2021/914" -- SCC decision

For national legislation (by jurisdiction):

• Italy: site:normattiva.it "196/2003" articolo {N} -- Codice Privacy
• Italy: site:gazzettaufficiale.it {decreto/legge reference}
• Germany: site:gesetze-im-internet.de {BDSG/TTDSG reference}
• France: site:legifrance.gouv.fr "loi informatique" OR "CNIL"
• Spain: site:boe.es "proteccion de datos" OR "LOPDGDD"
• USA/California: site:leginfo.legislature.ca.gov "1798" {section}
• Brazil: site:planalto.gov.br "LGPD" OR "13709"
• Switzerland: site:fedlex.admin.ch "235.1" OR "DSG"
• UK: site:legislation.gov.uk "data protection act 2018" OR "UK GDPR"

For DPA guidelines (by authority):

• EU: site:edpb.europa.eu guidelines {topic} {year}
• Italy: site:garanteprivacy.it {docweb number} -- Garante provvedimenti
• Italy: site:garanteprivacy.it "linee guida" {topic}
• France: site:cnil.fr {topic} guidelines
• Germany: site:datenschutzkonferenz-online.de {topic}
• UK: site:ico.org.uk guidance {topic}
• Spain: site:aepd.es guia {topic}
• Brazil: site:gov.br/anpd {topic}

For case law:

• CJEU: site:curia.europa.eu "Planet49" or "C-673/17" -- case numbers
• ECLI:{case identifier} -- European Case Law Identifier
• National courts: search by case number + court name + "data protection"

Search Sequencing

Phase 1 -- Verify normative basis (BEFORE drafting):

• Run 3+ parallel WebSearch queries for the key regulations applicable to the user's scenario
• Confirm article numbers, amendment status, and effective dates
• Check for recent Garante/EDPB decisions that modify interpretation

Phase 2 -- Sector and jurisdiction check:

• If sector overlay active: search for sector-specific guidance and recent enforcement
• If extra-EU jurisdictions: search for current adequacy decisions, SCC updates
• If transfer mechanisms involved: verify DPF certification status, SCC version currency

Phase 3 -- Triangulation for high-risk clauses:

• For clauses involving consent, special categories, DPIA, or transfers: require minimum 2 independent official sources
• If sources conflict: flag the discrepancy, cite both, mark as [REQUIRES LEGAL REVIEW]
• For cookie/tracker clauses: cross-check ePrivacy text + Garante guidelines + CJEU jurisprudence

WebFetch for Source Extraction

When WebSearch finds a relevant official source:

1. WebFetch the specific page -- request only the relevant section (article, recital, guideline paragraph)
2. Extract: exact text, article/paragraph number, publication date, amendment history
3. Store as evidence for the clause metadata

Recency Validation

Before generating any document:

• Check if cited guidelines have been updated or superseded
• Search site:edpb.europa.eu and site:garanteprivacy.it for the current year to catch new guidance
• If a key source is older than 2 years: actively search for updates or confirmations
• Note the "last verified" date in the evidence pack

Research Output

For each document, produce an internal research log (included in evidence pack):

## Research Log
- Queries executed: {count}
- Official sources verified: {list with URLs}
- High confidence: {clauses with 2+ official sources}
- Medium confidence: {clauses with 1 official source}
- Needs verification: {clauses relying on training data only}
- Source recency: {oldest source date} to {newest source date}