Vertical #10 of Supreme Operating System · UK GDPR / DPA 2018
gdpr.law
UK GDPR compliance SaaS for the 5.5m UK businesses that must comply with the Data Protection Act 2018 — and most never have. DSAR 30-day clock, breach 72-hour ICO notification window, privacy notices, DPAs, India QA reviewed. Every employ.law, landlord.tax and Sole.tax user is a warm cross-sell.
Regulatory hook (the urgency): UK GDPR / DPA 2018 makes ICO registration compulsory for most data controllers — and ICO fines escalate to £17.5m or 4% of global turnover. The DSAR statutory 30-day window has no SME tracking tool. The breach 72-hour notification window almost no micro-business knows about. AI tools (ChatGPT, Claude, etc.) just created brand-new processing obligations for every UK SME.
Headline numbers
5.5m
UK businesses must comply
£19-79/mo
Three pricing tiers
£922k
Y1 ARR target (3,200 subs)
This folder
CLAUDE.md
System context, regulatory hook, pricing, agent assignments, session rules. The 195-line operating manual.
STRATEGY.html
Market thesis · 5 urgency drivers · competitive landscape · exit comparables (DataGuard, OneTrust SME) · Y1-3 revenue model.
LANDING_PAGE.html
Customer-facing site. DSAR 30-day clock framing — "is one already running?" — plain English, plumber-with-a-website first.
RUNTIME_DASHBOARD.html
Operations view: India QA queue, DSAR clock pipeline, breach notification watchlist, ICO enforcement feed, system health.
BACKEND_CONTRACT.md
Tech endpoints, DB schema, activation sequence, deploy specs. Owns runtime integration.
SNAP_MANIFEST.json
Component registry: 5 JS modules, 5 n8n workflows, 5 doc templates, 15 env vars (v1.0.0 — 90% stack reuse).
Already built (technical state, 14 May 2026)
| Asset | Count | Location | State |
|---|
| JavaScript snap modules | 5 | snap_modules/ | Pure functions, zero deps · ready to wire |
| n8n workflows | 5 | n8n_workflows/ | tables on gdpr_ chain · Supabase-node params need real-API translation before import (1 cron auto-active) |
| SQL migrations | 5 | runtime/supabase_migrations/ (sql_005–sql_009) | NOT YET APPLIED · Cowork queue · root db/migrations/005 + 005b = unused forks, do NOT apply |
| HTML doc templates | 5 | ../../templates/gdpr-law/ | ready to use |
| Railway deployment | 1 | railway/ | Dockerfile + 15 env vars |
Cross-vertical role (donor + receiver)
| Direction | Vertical | Contract |
|---|
| ← Receiver | employ.law | Week-4 auto upsell — staff records = personal data → DSAR-ready obligation kicks in |
| ← Receiver | landlord.tax | Auto upsell — tenant personal data (names, addresses) triggers controller obligation |
| ← Receiver | sole.tax | Auto upsell — customer/supplier data processing → Starter tier prompt |
| ← Receiver | aibritains.co.uk · gdprsnap | Top-of-funnel DSAR clock check → BRG routing_band → gdpr.law trial |
| Donor → | Supreme Capital (cyber) | Breach incident logged → SC cyber insurance webhook · referral fee on policy bind |
| Donor → | Supreme Capital (legal) | High-risk DPA flagged → SC legal-advice referral · AR network handles regulated advice |
Pricing tiers
| Tier | Price | What's included |
|---|
| Starter | £19/mo | Privacy notice generator · ICO registration guide · DSAR 30-day clock |
| Growth | £49/mo | + DPA generator · breach 72-hour notifier · document storage · India QA |
| Pro | £79/mo | + DPO advisory hours · multi-entity · white-label · cross-vertical reseller |
Architecture decision pending (Craig)
Before Phase 2, Craig decides hosting architecture: (A) n8n standalone on Railway · (B) FastAPI port (translate workflow logic into app.py + PyExecJS) · (C) Hybrid (n8n for doc gen + crons; FastAPI for snap endpoints). Same decision tree as employ.law. Recommendation in BACKEND_CONTRACT.md.
Activation sequence (Week 1-5)
Week 1: Apply runtime chain sql_005–sql_009 → set SUPABASE_SERVICE_ROLE_KEY + ANTHROPIC_API_KEY
Week 1: Import n8n 03_dsar_tracker (CRON 0 7 * * * — AUTO-ACTIVE on import)
Week 2: Activate FEATURE_INDIA_QA = true (after Aftab's team trained on UK GDPR vs EU GDPR)
Week 3: Set up SC cyber-insurance webhook + import 05_sc_referral
Week 4: Wire cross-vertical upsell emails from employ.law / landlord.tax / sole.tax
Week 5: Flip FEATURE_GDPR_LAW_LIVE = true + FEATURE_SC_REFERRALS = true
Session rules (canonical, from CLAUDE.md)
| Always | UK GDPR framing — "you are LEGALLY required", not "best practice" |
| Always | plain English — plumber with a website, not a DPO |
| Always | ICO enforcement hook — real fines, real companies (ICO enforcement feed from Cluster 1) |
| Always | DSAR 30-day clock is the primary hook — "do you even know if one is running right now?" |
| Always | Breach 72-hour window is the second hook — "most breaches are reported late. Late = fine." |
| Never | give legal advice — "GDPR compliance tool, not a lawyer" |
| Never | guarantee ICO outcome — "positions you for compliance, not a legal shield" |