A Graph RAG GDPR Compliance Verifier for SME Legal Risk Analysis
Challenges
SMEs struggled to interpret GDPR requirements and enforcement risks.
GDPR rules and enforcement cases existed across disconnected data sources.
Vector search alone could not capture complex legal relationships and patterns.
Outcome
97% response relevancy with the full summariser pipeline.
91.8% context precision with reference.
80% faithfulness with graph enriched retrieval and query derived context.
Solution
GDPR Compliance Verifier
Challenges
Solution
Technology Stack
Outcomes
A legal sector organisation wanted to make GDPR compliance guidance more accessible to small and medium sized enterprises. The organisation did not face challenges in retrieving GDPR regulations. It also needed to understand how those regulations had been interpreted and enforced across different European jurisdictions. SMEs wanting to get that interpretation had to rely on corporate legal expertise, which could be expensive.
Cloudaeon worked on a GDPR Compliance Verifier designed to analyse this problem through AI.
Challenges
SMEs Needed Practical Compliance Guidance, More Than Just Access to GDPR Text: The regulation itself was available, but knowing whether a company's practices created compliance risk required interpretation. For SMEs, maintaining access to corporate lawyers or dedicated legal teams could be expensive. The goal was therefore to create a system that could use company information and regulatory knowledge to support compliance assessment and recommendations.
GDPR Enforcement Varied Across European Jurisdictions: GDPR had been in force since 2018, but enforcement was not uniform across Europe. Some jurisdictions applied significant penalties, while enforcement elsewhere could be less strict. Companies therefore needed a way to understand not only the regulation but also how it had been enforced in real cases.
Regulation and Enforcement Data Existed Separately: The GDPR enforcement archive contained company, jurisdiction, violation and decision information. The Data Privacy Vocabulary (DPV) provided the structured ontology of privacy law. The challenge was connecting these two sources so the system could relate legal concepts to real enforcement cases.
Standard Vector Retrieval Could Not Answer Relationship Heavy Questions: Some questions depended on relationships between companies, countries, violations and decisions. For example, cross border patterns might not appear explicitly in the source text. A vector database alone could therefore miss information that had to be derived from the graph.
High Quality Legal Evaluation Data Was Difficult to Obtain: Reliable legal AI required reliable evaluation data. The project also faced limited data availability because relevant compliance information was not always disclosed. This made benchmark dataset creation and evaluation an important part of the work.
Root Cause Analysis
We did not immediately build a standard RAG application. We first examined how GDPR regulations, enforcement cases and legal relationships were represented. We identified three core issues:
The legal ontology and real enforcement cases existed as separate sources.
Many compliance questions depended on relationships that vector search alone could not identify.
Raw graph records were not in a format the LLM could interpret effectively.
This led us to combine knowledge graphs, Graph RAG and LLM readable representations instead of relying only on conventional document retrieval.
Solution
Cloudaeon built a GDPR Compliance Verifier using a Graph RAG architecture. We connected GDPR enforcement cases with the Data Privacy Vocabulary, enriched the resulting knowledge graph and converted key graph information into text that could be retrieved by an LLM. The system could then answer GDPR related questions using both regulatory structure and historical enforcement context, while multiple retrieval pipelines were evaluated against a baseline RAG approach.
How We Delivered
Linked GDPR Enforcement Cases to the Privacy Law Ontology: We started by connecting enforcement cases from the GDPR archive with corresponding concepts in the Data Privacy Vocabulary. This process used entity linking. A case could contain information about a company, its country, the GDPR article or clause involved and the resulting decision. We linked those case level details to the appropriate concepts within DPV's legal hierarchy. This brought the regulation's structure and its real enforcement history into a common representation.
Built and Enriched the GDPR Knowledge Graph: From the linked data, we created a knowledge graph containing approximately:
6,800 nodes
42,000 relationships
The graph was enriched with company names, countries, violated legal provisions and decisions associated with enforcement cases. This allowed the system to use relationships between legal concepts and real cases instead of relying only on document similarity.
Converted Graph Data into LLM Assistive Text: We converted information associated with case nodes from key-value representations into free flowing text. These became LLM assistive fields. We also created structural assistive fields that described how cases connected to countries, companies, legal terms and decisions. This made important graph context easier for the LLM to retrieve and interpret.
Added Graph Derived Analytics for Complex Questions: Some compliance questions depended on information that did not exist as literal text in the source documents. Cross border enforcement patterns were one example. We therefore used advanced Cypher and SQL style queries to extract relationships and analytical results from the graph. These results were then converted into text so they could also participate in retrieval.
Added Partial and Full Case Summarisation: We created both partial summariser and full summariser representations of the case material. This allowed us to test how different levels of condensed context affected response quality. The evaluation later showed an important trade off. Summaries could improve relevance, but excessive summarisation could remove information and reduce faithfulness.
Built and Compared Three Retrieval Pipelines: We created multiple retrieval approaches instead of relying on a single design. The first used baseline case text. The second added LLM assistive fields, structural assistive fields and summaries. The third extended this further with analytical information extracted through advanced graph queries. This allowed us to compare how each additional layer affected retrieval and answer quality.
Converted the Architecture into a Graph RAG Workflow: When a user submitted a question, the system searched a vector database containing textual representations derived from the knowledge graph. Relevant chunks were retrieved and passed to the LLM, which generated the final response. The knowledge graph provided the relationships and analytical context, while the vector layer made that information retrievable.
Evaluated Retrieval and Generation Separately: For the retriever, we used context precision and context recall. For the generator, we used response relevancy and faithfulness. This allowed us to identify which pipelines retrieved the best context and which produced the most relevant and faithful answers.
Technology Stack
Data Privacy Vocabulary (DPV)
GDPR enforcement archive
Knowledge Graph
Graph RAG
Vector Database
Large Language Models
Cypher
SQL
Outcome
Evaluation against the baseline RAG pipeline produced the following results:
91.8% context precision with reference
67.3% context precision without reference
58% context recall despite the relatively small example set
97% response relevancy with the full summariser pipeline
80% faithfulness with the enriched pipeline incorporating graph information and advanced query derived context
Conclusion
The challenge was not simply searching GDPR documentation. It was connecting legal rules with how those rules had actually been interpreted and enforced. Cloudaeon combined legal ontology, enforcement data and Graph RAG to create a compliance system that could retrieve this context more effectively and measure the quality of its answers.
If your compliance teams need to understand not only what regulations say, but how those rules connect to real enforcement cases, Cloudaeon can help build a governed retrieval system around that knowledge. Talk to an expert now.