diff --git a/.eslintplugin/no-bad-gdpr-comment.js b/.eslintplugin/no-bad-gdpr-comment.js
new file mode 100644
index 000000000000..786259683ff6
--- /dev/null
+++ b/.eslintplugin/no-bad-gdpr-comment.js
@@ -0,0 +1,51 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+var noBadGDPRComment = {
+    create: function (context) {
+        var _a;
+        return _a = {},
+            _a['Program'] = function (node) {
+                for (var _i = 0, _a = node.comments; _i < _a.length; _i++) {
+                    var comment = _a[_i];
+                    if (comment.type !== 'Block' || !comment.loc) {
+                        continue;
+                    }
+                    if (!comment.value.includes('__GDPR__')) {
+                        continue;
+                    }
+                    var dataStart = comment.value.indexOf('\n');
+                    var data = comment.value.substring(dataStart);
+                    var gdprData = void 0;
+                    try {
+                        var jsonRaw = "{ ".concat(data, " }");
+                        gdprData = JSON.parse(jsonRaw);
+                    }
+                    catch (e) {
+                        context.report({
+                            loc: { start: comment.loc.start, end: comment.loc.end },
+                            message: 'GDPR comment is not valid JSON',
+                        });
+                    }
+                    if (gdprData) {
+                        var len = Object.keys(gdprData).length;
+                        if (len !== 1) {
+                            context.report({
+                                loc: { start: comment.loc.start, end: comment.loc.end },
+                                message: "GDPR comment must contain exactly one key, not ".concat(Object.keys(gdprData).join(', ')),
+                            });
+                        }
+                    }
+                }
+            },
+            _a;
+    },
+};
+module.exports = {
+    rules: {
+        'no-bad-gdpr-comment': noBadGDPRComment, // Ensure correct structure
+    },
+};
diff --git a/.eslintplugin/no-bad-gdpr-comment.ts b/.eslintplugin/no-bad-gdpr-comment.ts
new file mode 100644
index 000000000000..1eba899a7de3
--- /dev/null
+++ b/.eslintplugin/no-bad-gdpr-comment.ts
@@ -0,0 +1,55 @@
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) Microsoft Corporation. All rights reserved.
+ *  Licensed under the MIT License. See License.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+
+import * as eslint from 'eslint';
+const noBadGDPRComment: eslint.Rule.RuleModule = {
+    create(context: eslint.Rule.RuleContext): eslint.Rule.RuleListener {
+        return {
+            ['Program'](node) {
+                for (const comment of (node as eslint.AST.Program).comments) {
+                    if (comment.type !== 'Block' || !comment.loc) {
+                        continue;
+                    }
+                    if (!comment.value.includes('__GDPR__')) {
+                        continue;
+                    }
+
+                    const dataStart = comment.value.indexOf('\n');
+                    const data = comment.value.substring(dataStart);
+
+                    let gdprData: { [key: string]: object } | undefined;
+
+                    try {
+                        const jsonRaw = `{ ${data} }`;
+                        gdprData = JSON.parse(jsonRaw);
+                    } catch (e) {
+                        context.report({
+                            loc: { start: comment.loc.start, end: comment.loc.end },
+                            message: 'GDPR comment is not valid JSON',
+                        });
+                    }
+
+                    if (gdprData) {
+                        const len = Object.keys(gdprData).length;
+                        if (len !== 1) {
+                            context.report({
+                                loc: { start: comment.loc.start, end: comment.loc.end },
+                                message: `GDPR comment must contain exactly one key, not ${Object.keys(gdprData).join(
+                                    ', ',
+                                )}`,
+                            });
+                        }
+                    }
+                }
+            },
+        };
+    },
+};
+
+module.exports = {
+    rules: {
+        'no-bad-gdpr-comment': noBadGDPRComment, // Ensure correct structure
+    },
+};
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 979b26459d06..3fcf1dabea99 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -11,6 +11,7 @@ import noOnlyTests from 'eslint-plugin-no-only-tests';
 import prettier from 'eslint-config-prettier';
 import importPlugin from 'eslint-plugin-import';
 import js from '@eslint/js';
+import noBadGdprCommentPlugin from './.eslintplugin/no-bad-gdpr-comment.js';
 
 export default [
     {
@@ -273,6 +274,7 @@ export default [
             'no-only-tests': noOnlyTests,
             import: importPlugin,
             prettier: prettier,
+            'no-bad-gdpr-comment': noBadGdprCommentPlugin,
         },
         settings: {
             'import/resolver': {
@@ -282,6 +284,7 @@ export default [
             },
         },
         rules: {
+            'no-bad-gdpr-comment/no-bad-gdpr-comment': 'error',
             // Base configurations
             ...tseslint.configs.recommended.rules,
             ...prettier.rules,