Article30

What the company appears to be: Article30 is a self-reported tool that scans codebases for personal data fields, traces their flow, and drafts GDPR Article 30 register reports. It claims to automate a compliance task that is currently done manually by stale spreadsheets.

What changed: The author states they built this in a single Codex session using GPT-5.6 Terra, with an architecture defined via one detailed prompt. They claim the tool uses GPT-5.6 for both building and classifying data fields.

Single most important open question: Is there any evidence of actual usage or adoption beyond the author's own development environment?

The description states that Article30 is a tool that:

• Scans code repositories
• Identifies personal data fields in database schemas and models
• Uses GPT-5.6 to semantically classify these fields into categories (identity, contact, financial, special category)
• Traces where the data flows to third parties or across borders
• Detects leaks (e.g., personal data in logs)
• Generates a draft Article 30 register as HTML and JSON

It is described as a draft generator, not legal advice.

Evidence: The author's own write-up. No external verification.

Inference: The tool appears to be built using AI-assisted development with Codex and GPT-5.6 for both code generation and classification logic.

The description states that Article30 addresses a compliance problem:

• GDPR Article 30 requires organisations processing personal data in the EU to maintain a Record of Processing Activities.
• This register is typically maintained as a stale spreadsheet, not updated with code changes.
• The tool reads existing code and automates what would otherwise be a manual process.

It positions itself as solving an unenjoyable but necessary task — one that no one wants to own.

Evidence: Self-reported by the author. No third-party validation or market positioning data provided.

Inference: The product is positioned as a compliance automation tool for developers and DPOs, aiming to reduce manual effort in maintaining GDPR records.

The description implies that Article30 targets:

• Organisations processing personal data in the EU
• Compliance officers (DPOs)
• Developers who manage codebases with personal data

It is not clear if it targets specific industries or company sizes, nor whether there are distinct buyer personas.

Evidence: The author's own write-up. No explicit segmentation or customer profile provided.

Inference: Likely aimed at mid-to-large tech companies or startups that must comply with GDPR and have codebases containing personal data.

The description does not state anything about pricing, monetisation, or business model.

It is unclear if the tool will be offered as a SaaS product, open-source, or otherwise.

Evidence: Not evidenced.

Inference: No evidence of any commercial structure beyond the author's own development effort.

The description states:

• Built using Codex with GPT-5.6 Terra
• Uses FastAPI for a web UI
• Implements a four-stage engine: scanner → classifier → flow tracer → report generator
• Uses regex and GPT-5.6 for classification
• Includes response caching to ensure determinism in classifications
• Has verification mechanisms built into the build process (e.g., planted leaks, ambiguous fields)
• The author claims Codex delivered a runnable skeleton with passing tests in under an hour

Evidence: Self-reported by the author.

Inference: The tool is AI-assisted in both development and execution. It uses structured output from GPT-5.6 for classification and has some built-in verification logic to ensure correctness.

There is no evidence of any traction, revenue, customers, or adoption beyond the author’s own development.

The project was submitted to a hackathon (OpenAI 2026), suggesting it is early-stage.

Evidence: Not evidenced.

Inference: The tool appears to be in an experimental or prototype phase, with no known users or market validation.

The description does not mention any competitors or existing solutions in the GDPR compliance space.

It also doesn’t describe how Article30 compares technically or functionally to other tools.

Evidence: Not evidenced.

Inference: No competitive landscape is described. The author does not reference similar tools or platforms.

• Unverified claims: All evidence is self-reported and unverified.
• No traction or adoption: No customers, revenue, or usage data.
• AI dependency: Heavy reliance on GPT-5.6 for both building and running the tool raises questions about scalability, cost, and availability.
• Limited scope: The tool only generates drafts; it is not legal advice or a full compliance system.
• Hackathon origin: Submitted to a hackathon suggests early-stage development with no commercial traction.

Evidence: Not evidenced.

Inference: Risks include lack of real-world testing, overreliance on AI models, and absence of any business model or product-market fit evidence.

1. What is the actual accuracy rate of GPT-5.6 in classifying personal data fields?
2. How does the tool handle false positives or ambiguous classifications?
3. Has the tool been tested on real-world codebases beyond the sample fixture?
4. Are there any plans for CI/CD integration or enterprise deployment?
5. What is the long-term vision for monetisation or product evolution?
6. Is there a plan to support other EU regulations beyond GDPR?