GDPR obligations of a company
gdpr_obligationsRead-onlyIdempotent
Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ai | No | True if it develops or uses AI systems that interact with or make decisions about people. | |
| cctv | No | True if it uses video surveillance (CCTV). | |
| country | Yes | Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT). | |
| website | No | True if the company has a website or app. | |
| employees | No | Number of employees (0 if none). | |
| processors | No | True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted. | |
| large_scale | No | True if the processing concerns a large number of people (large scale). | |
| public_sector | No | True if the organisation is a public authority or public body. | |
| email_marketing | No | True if the company sends marketing e-mails or SMS to individuals. | |
| vulnerable_people | No | True if it processes data of vulnerable people (children, patients, elderly people). | |
| automated_decisions | No | True if it takes automated decisions with legal or similarly significant effects on people. | |
| evaluation_or_scoring | No | True if it evaluates or scores people (credit scoring, profiling, performance rating). | |
| non_essential_cookies | No | True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels). | |
| special_category_data | No | True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions). | |
| systematic_monitoring | No | True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas). | |
| transfers_outside_eea | No | True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS). |