How this check works

1. Overview

Every obligation we track is an atomic duty drawn from a named law, tagged with the article or section it comes from and the category it belongs to (governance, lawful basis, transparency, data-subject rights, security, breach, transfers, and so on). When you run a check, two things happen: an applicability engine decides which laws and which obligations apply to your organisation, and a severity-weighted score measures how much of what applies you already have in place. Both are described below, and you can inspect the underlying obligations and their citations in the comparison view.

2. What we cover

These are the frameworks currently modelled. Each links to its official source so you can verify any obligation yourself.

3. How we decide what applies to you

Applicability is resolved in two layers from the answers you give on the start form — we never assume a law applies just because it is in the list.

Which laws apply (framework level)

• GDPR applies if you process data of people in the EU/EEA, or your organisation is established there.
• Ghana, Kenya and Nigeria Acts each apply if you process data of that country's residents, or you are established in that country.
• CCPA/CPRA applies if you target California residents and cross a statutory threshold — roughly US$25m revenue or 100,000+ consumers. Below the threshold we tell you the duties may still reach you through your contracts.

Which obligations apply (requirement level)

Most obligations apply to everyone a framework covers. Some are switched on only by what you do:

• A DPIA becomes mandatory when you flag high-risk processing — automated decision-making, health, biometric, or children's data.
• A DPO / privacy lead is required for large-scale special-category processing or once you reach ~10,000 data subjects (and stays best practice below that).
• An international-transfer mechanism is required when you indicate cross-border transfers.
• Children's safeguards switch on when you process children's data; the Do-Not-Sell/Share link switches on for California consumers.

Each applicable obligation in your result carries a one-line rationale explaining why it was included, so nothing is a black box.

4. How the readiness score works

For every obligation that applies, you answer Yes (in place), Partial (in progress) or No (not in place). Those map to completion of 100%, 50% and 0%. Anything you leave unanswered counts as No, so the score never flatters you.

Each obligation is weighted by its severity (1–5), and the score is the share of weighted obligations you have met — calculated per jurisdiction, and overall:

Worked example

Say three obligations apply, with severities 5, 3 and 2. You mark them Yes, Partial and No:

Weighting means a single critical gap moves the needle more than several minor ones — which is how a regulator would see it too.

5. Severity weighting

Every obligation is assigned a weight from 1 to 5 reflecting its enforcement exposure and how foundational it is. The current distribution across all 40 obligations:

6. Keeping it current

Every obligation cites the article or section it is drawn from and links to the official source, so the content is auditable rather than asserted. For each framework we publish when it was last reviewed against that source, the exact edition we checked, and our confidence that the modelled obligations still match the law.

Change history

• 2026-06-01 GDPR — Reviewed against the consolidated Regulation; modelled obligations unchanged.
• 2025-05-01 GDPR — Initial modelling of core obligations (Arts. 5, 6, 12–14, 15–22, 30, 32, 33–34, 35, 37–39, 44–50).
• 2026-06-01 Ghana DPA 2012 — Reviewed against Act 843; obligations current.
• 2025-05-01 Ghana DPA 2012 — Initial modelling of registration, principles, consent, notice, security, rights and transfer duties.
• 2026-06-01 Kenya DPA 2019 — Reviewed against the 2019 Act and ODPC guidance; obligations current.
• 2025-05-01 Kenya DPA 2019 — Initial modelling of registration, principles, consent, notice, rights, breach, DPIA and transfer duties.
• 2026-06-01 Nigeria NDPA 2023 — Reviewed against the 2023 Act; held at Medium confidence while NDPC subsidiary regulations continue to develop.
• 2025-05-01 Nigeria NDPA 2023 — Initial modelling of principles, lawful basis, notice, rights, security, breach, DPO, ROPA and transfer duties.
• 2026-06-01 CCPA/CPRA — Reviewed against the CPRA-amended statute; held at Medium confidence while CPPA rulemaking is ongoing.
• 2025-05-01 CCPA/CPRA — Initial modelling of notice, consumer rights, opt-out-of-sale/share, contracts, sensitive-data and security duties.

Reviews are carried out by our content team against the official sources and recorded above. Because data-protection law moves quickly, you can subscribe to law-update notices for any jurisdiction and we will email you when something material changes.

7. What this does not do

• It is not legal advice. The result is informational. Have qualified counsel review anything you rely on for a regulatory decision.
• It is a self-assessment, not an audit or certification. The score reflects only what you report about yourself; nothing is independently verified.
• The legal content is a best-effort paraphrase of public sources, condensed for clarity. The authoritative text is whatever the official source link says.
• Coverage is limited to the frameworks listed above. Sector-specific rules and laws in other countries or US states are not assessed.
• Applicability uses high-level triggers. Genuine edge cases can differ — treat the output as a well-reasoned starting point, not a final determination.

Questions about the method? Email support@spatialsusty.com.