Regulation Profiles
Configure the data protection regulations (GDPR, CCPA, LGPD, PDPA) your platform enforces — each profile defines DSR deadlines, default retention periods, and consent versioning.
Regulation Profiles are the foundation of SCRIPE's Compliance module. Each profile represents a specific data protection law that the platform enforces, storing the legal DSR response deadline, default retention periods, and the active consent document version. Profiles are seeded on startup and can be extended or overridden by platform administrators.
What Are Regulation Profiles?
A RegulationProfile is the authoritative record of a regulatory framework's enforcement parameters. When a Data Subject Request is submitted, the system reads the active RegulationProfile to calculate the SLA deadline. When the CurrentConsentVersion changes, the ConsentExpiryJob flags all active consents as requiring re-consent per GDPR Article 7.
RegulationProfile Entity
Each row represents one regulation and stores all the parameters needed to enforce it across DSR, consent, and retention sub-systems.
| Field | Type | Description |
|---|---|---|
| Code | string (max 20) | Short code identifier, e.g. "GDPR", "CCPA", "LGPD", "PDPA". |
| Name | string (max 200) | Full regulation name, e.g. "General Data Protection Regulation". |
| Jurisdiction | string? (max 50) | Region/country code, e.g. "EU", "US-CA", "BR", "TH". Null if global. |
| DsrDeadlineDays | int | Legal deadline for DSR response in days. Default 30 (GDPR). CCPA = 45. |
| DefaultRetentionJson | string? | JSON map of default retention periods per category (days). -1 = indefinite. e.g. {"UserProfile": 1095}. |
| ReferenceUrl | string? (max 500) | URL to the official regulation text or summary page shown in the compliance dashboard. |
| CurrentConsentVersion | string? (max 50) | Semantic version of the active consent text (e.g. "1.0", "2.1"). Changing this triggers re-consent for all active consents (GDPR Art. 7). |
| IsActive | bool | Whether this profile is available for tenants to select. Inactive profiles are hidden from the compliance UI. |
Pre-Seeded Regulations
SCRIPE seeds the following regulations on startup. Administrators can extend this list or override parameters without code changes via the compliance admin panel.
| Code | Name | Jurisdiction | DSR SLA |
|---|---|---|---|
| GDPR | General Data Protection Regulation | EU/EEA | 30 days |
| CCPA | California Consumer Privacy Act | US-CA | 45 days |
| LGPD | Lei Geral de Proteção de Dados | BR | 15 days |
| POPIA | Protection of Personal Information Act | ZA | 30 days |
| PDPA | Personal Data Protection Act | SG/TH | 30 days |
Consent Version & Re-Consent Trigger
The CurrentConsentVersion field stores the semantic version of the active consent policy document. When this value is updated (e.g. from '1.0' to '2.0'), the ConsentExpiryJob automatically scans all active ConsentSnapshots and sets RequiresReConsent = true, forcing users to re-acknowledge the updated terms before their consent is valid again.
DefaultRetentionJson Format
The DefaultRetentionJson field stores a JSON object mapping retention category keys to their default period in days. These defaults pre-populate new RetentionPolicy rows when the regulation is first activated for a tenant. Values of -1 indicate indefinite retention.
{
"UserProfile": 1095,
"AuditLogs": 1825,
"LoginHistory": 365,
"ConsentRecords": 2190,
"DsrRequests": 2190,
"TransactionLogs": 2555
}DefaultRetentionJson is informational — actual enforcement is done by RetentionPolicy rows, which can be customized per tenant beyond these defaults.
API Endpoints
Regulation profile endpoints allow admins to configure which regulations the platform enforces. System-seeded profiles can be updated but not deleted.
| Method | Endpoint | Description | Auth |
|---|---|---|---|
| GET | /api/v1/compliances/regulations | List all active regulation profiles applicable to the tenant. | 🔒 Required |
| GET | /api/v1/compliances/regulations/{id} | Retrieve details and statutory thresholds of a specific regulation profile. | 🔒 Required |
| POST | /api/v1/compliances/regulations | Create a custom jurisdictional compliance regulation profile. | 🔒 Required |
| PUT | /api/v1/compliances/regulations/{id} | Update an existing regulation profile's thresholds and notification settings. | 🔒 Required |
| DELETE | /api/v1/compliances/regulations/{id} | Delete or retire a custom regulation profile. | 🔒 Required |