Compliance Module

The Compliance module is SCRIPE's built-in regulatory compliance engine. It helps platform operators and their tenants stay compliant with major data protection laws (GDPR, CCPA, PDPA) through automated tools for managing data subject requests, consent records, retention policies, and generating audit-ready compliance reports.

What is the Compliance Module?

The Compliance module provides six interconnected sub-systems that cover the full compliance lifecycle. Instead of building compliance tooling from scratch, SCRIPE tenants get a production-ready system that tracks, automates, and reports on their data protection obligations.

• Data Subject Requests

  Handles Subject Requests including Export, Erasure, Rectification, and Restriction with full lifecycle tracking and SLA monitoring.

• Consent Management

  Immutable tracking of consent states, snapshots, and audit trails for GDPR Article 6 and CCPA compliance.

• Retention Policies

  Enforces data destruction policies based on configurable retention periods with automated Delete or Anonymize actions.

• Data Inventory

  Maps sensitive PII locations across modules — required for GDPR Article 30 Records of Processing Activities (RoPA).

• Compliance Reports

  Generates async audit-ready reports (GDPR Overview, DSR Summary, Consent Audit, Retention Analysis, Data Inventory Export).

• Webhook Events

  11 real-time webhook events covering DSR lifecycle, consent changes, retention enforcement, and report generation.

Six Sub-Systems

Each sub-system handles a specific compliance domain:

Supported Regulations

SCRIPE's Compliance module supports enforcement of these major data protection regulations. Each regulation is pre-seeded with its SLA deadlines and penalty structures.

Backend Architecture

The Compliance backend follows the standard SCRIPE 3-project module layout (Domain / Application / Infrastructure) with a dedicated ComplianceDbContext and ComplianceController.

public class ComplianceDbContext : DbContext
{
    public DbSet<DataSubjectRequest> DsrRequests { get; set; }
    public DbSet<DsrModuleExecution> DsrModuleExecutions { get; set; }
    public DbSet<DsrStatusHistory> DsrStatusHistories { get; set; }
    public DbSet<ConsentRecord> ConsentRecords { get; set; }
    public DbSet<ConsentPurpose> ConsentPurposes { get; set; }
    public DbSet<ConsentSnapshot> ConsentSnapshots { get; set; }
    public DbSet<RetentionPolicy> RetentionPolicies { get; set; }
    public DbSet<RetentionExecution> RetentionExecutions { get; set; }
    public DbSet<DataInventoryItem> DataInventoryItems { get; set; }
    public DbSet<ComplianceReport> ComplianceReports { get; set; }
    public DbSet<RegulationProfile> RegulationProfiles { get; set; }
}

CQRS Commands & Queries

The Compliance module uses the standard SCRIPE mediator CQRS pattern. Commands handle write operations and Queries handle read operations, each with dedicated FluentValidation validators.

Frontend Architecture

The frontend is organized as six independent sub-modules under src/modules/compliance/, each with its own domain, data, and presentation layers following the View/ViewModel pattern.

src/modules/compliance/
├── di.ts                       # Dependency Injection container
├── index.ts                    # Public exports
├── dashboard/                  # Dashboard sub-module
│   └── src/presentation/views/
├── dsr/                        # Data Subject Requests
│   └── src/{domain,data,presentation}/
├── consent/                    # Consent Management
│   └── src/{domain,data,presentation}/
├── retention/                  # Retention Policies
│   └── src/{domain,data,presentation}/
├── inventory/                  # Data Inventory
│   └── src/{domain,data,presentation}/
└── reports/                    # Compliance Reports
    └── src/{domain,data,presentation}/

API Endpoints Overview

All endpoints are under /api/v1/compliances/ and require authentication with the compliance.view permission.

Webhook Events

The Compliance module fires 11 real-time webhook events that external systems can subscribe to. Events are auto-registered via the ComplianceWebhookEventCatalog and dispatched through the IWebhookDispatcher pipeline.

Quick Start Guide

1. 1

   Seed Compliance Data

   Run the development seeder to populate regulation profiles, sample consent purposes, and retention policies for your test environment.
   Shell

   Copy

   scripe db seed --dev -m Compliance

2. 2

   Configure Regulation Profiles

   Navigate to Compliance → Regulations in the admin panel. Enable the regulations your platform operates under (GDPR, CCPA, PDPA). Each regulation defines the SLA deadlines and penalty structures that will be enforced.
3. 3

   Submit a Test DSR

   Create a Data Subject Request to test the full lifecycle. The system will validate the request, calculate the SLA deadline, and make it available for assignment to a compliance officer.
   JSON

   Copy

   POST /api/v1/compliance/dsr
   {
     "requestType": "Access",
     "regulationCode": "GDPR",
     "subjectEmail": "user@example.com"
   }

4. 4

   Record Consent & Configure Retention

   Set up consent purposes (Marketing, Analytics, Third-Party) and configure retention policies for each data category. The retention enforcement job will automatically apply the configured actions when data ages past the retention period.
5. 5

   Generate a Compliance Report

   Queue an async compliance report. The report will be generated in the background and appear in the Reports list once ready. Download it in CSV, JSON, XLSX, or PDF format.
   JSON

   Copy

   POST /api/v1/compliance/reports/generate
   {
     "reportType": "DSR_Summary",
     "periodStart": "2026-01-01",
     "periodEnd": "2026-05-01"
   }

Security Considerations

Compliance data is among the most sensitive in the platform. All endpoints are protected by JWT authentication, role-based authorization, and encrypted ID transit. Personal data in DSRs and consent records is subject to field-level security restrictions.

• ✅

  Recommended Practices

  • Enable field-level security for PII fields in DSR responses
  • Configure webhook secrets for all compliance event subscriptions
  • Set retention policies for compliance data itself (meta-compliance)
  • Review audit logs regularly for unauthorized access attempts
• ❌

  Anti-Patterns to Avoid

  • Never expose DSR endpoints without AdminOnly authentication
  • Never skip consent version tracking — it invalidates the audit trail
  • Never hard-delete compliance records — always use soft-delete
  • Never bypass the webhook dispatcher for compliance events