Rule set sha256:c63def17fac2
rego-gdpr5-1c-001
One rule of the rule set with digest c63def17fac2df12ab70941d8fcb7678e9a670479ea0d6dce87e7ddd4dc96079. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-gdpr5-1c-001 |
|---|---|
| Rule version | 6e723a63a4812216c6a240e4eec1298a8100510902622332a3820d853c6b58e8 |
| Provision | Regulation (EU) 2016/679, Article 5(1)(c) ELI: http://data.europa.eu/eli/reg/2016/679/art_5/par_1/pnt_c/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-22 (via agent review per §5.1 amendment v1.1) |
rules/rego/complyedge/data_protection/email.rego
- Citation
- Regulation (EU) 2016/679 (GDPR), Article 5(1)(c)
- Condition
- The text carries an email address. An email address identifies a person, so sending it to an AI model (or returning it to a user) is processing personal data beyond what the AI task needs. Addresses at the reserved example domains of RFC 2606 / RFC 6761 (example.com, .test, .example, .invalid) are documentation placeholders, not people, and do not fire.
- Layer 1 detects
- an email address, letters, digits and . _ % + - before the @, and a domain of one or more labels ending in a top-level domain of at least two letters, in any case, with no letter or digit directly before or after it; an address at example.com, example.org, example.net or a subdomain of them, or at a domain ending .test, .example, .invalid or .localhost does not fire. It matches formats, not purpose: it fires on every such value whatever the task, and it does not judge whether sending the value is necessary for the task (the Article 5(1)(c) test, which this rule does not apply). No model reviews a hit: a match keeps the block in Layer 2 as well.
- Condition type
- deterministic (format match; no judgment of meaning)
- Status in the file
- approved