Skip to main content
Glama
Sign In
deenesjakoruzh
GDPR Compliance for AI Systems MCP Server

GDPR Compliance for AI Systems MCP Server

by CSOAI-ORG
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

Verification is free and public: signed measurement cards and live verification at https://councilof.ai — measurement, not certification.

MCP Scorecard: 86/100

Gdpr Compliance Ai MCP

Council of AI PAYG enabled GSPC License PyPI

GDPR compliance MCP — DPIA automation, Article 30 records, Article 22 automated decision-making a...

GDPR compliance MCP — DPIA automation, Article 30 records, Article 22 automated decision-making audit, data subject request workflow.

🚀 Quick Start

# Install via pip
pip install gdpr_compliance_ai_mcp

# Or install via Smithery
npx -y @smithery/cli@latest install gdpr-compliance-ai-mcp --client claude

Related MCP server: conformite-ia-mcp

⚡ Pay-per-call (PAYG) — no subscription

This MCP supports universal pay-per-call billing across the MEOK compliance fleet:

# One-time setup
export MEOK_PAYG_KEY="your_topup_token"

# Every tool call now deducts £0.05 from your balance.
# When balance hits zero, the tool returns a top-up URL.
# Works across all 7 MEOK compliance MCPs with the same token.

  • No subscription — top up once, deduct per call.

  • £0.05/call default (configurable via MEOK_PAYG_RATE_GBP).

  • USDC on Base L2 accepted — set MEOK_X402_RECEIVER and pay via stablecoin.

  • Backward-compatible — when MEOK_PAYG_KEY is unset, behaviour is unchanged.

Get a token: councilof.ai/payg (£10 / £50 / £200 top-up tiers).

✨ Features

  • GDPR Chapter V compliance

  • Cross-region data guard

  • Data localization

  • Transfer mechanism validation

  • Breach detection

📖 Documentation

🛡️ Compliance

This MCP server is built with EU AI Act compliance built-in:

  • ✅ Article 9 — Risk Management System

  • ✅ Article 13 — Transparency & Instructions for Use

  • ✅ Article 15 — Bias Detection & Testing

  • ✅ Article 26 — FRIA Support (where applicable)

  • ✅ Article 50 — AI Content Watermarking (where applicable)

Need help getting compliant? Book a free 15-min diagnostic →

🏢 Enterprise

Need custom development, SLA guarantees, or white-label deployment?

View Pricing → | Contact Sales →

🤝 Part of the MEOK Ecosystem

This server is part of the Council of AI ecosystem — 26 PyPI packages · ~public measurement tools.

Domain

Purpose

councilof.ai

EU AI Act compliance marketplace

safetyof.ai

AI safety & monitoring

councilof.ai

Sovereign AI platform

cobolbridge.ai

Legacy modernization

📜 License

MIT © CSOAI-ORG

Configuration

Add to your claude_desktop_config.json (Claude Desktop) or your MCP client config:

{
  "mcpServers": {
    "gdpr-compliance-ai-mcp": {
      "command": "uvx",
      "args": ["gdpr-compliance-ai-mcp"]
    }
  }
}

Or: pip install gdpr-compliance-ai-mcp then run the gdpr-compliance-ai-mcp command (stdio transport).

Examples

Once configured, ask your assistant, for example:

  • "Use classify_processing to …"

  • "Use lawful_basis_assessment to …"

  • "Use dpia_generator to …"

Available Tools

6 tools
breach_notificationA

Assess breach severity and notification requirements under GDPR Articles 33-34 (72-hour rule). Determines whether supervisory authority and data subject notification is required, and generates the notification content.

Args:
    breach_description: Description of the personal data breach
    data_categories_affected: Types of personal data affected
    number_of_records: Approximate number of records/individuals affected
    breach_type: Type of breach: "confidentiality" (unauthorized access), "integrity" (unauthorized alteration), "availability" (unauthorized loss of access)
    detection_timestamp: When the breach was detected (ISO format, or "now")
    ai_system_involved: Whether an AI system was involved in the breach
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: breach_description (required), data_categories_affected (required), number_of_records, breach_type, +5 more. Returns: result

classify_processingA

Classify data processing activities per GDPR articles. Determines which GDPR articles apply, whether a DPIA is required, special category processing status, and automated decision-making obligations.

Args:
    processing_description: Description of the data processing activity
    data_categories: Types of personal data processed (e.g. ["name", "email", "biometric", "health"])
    data_subjects: Categories of data subjects (e.g. ["employees", "customers", "children"])
    processing_purposes: Purposes of processing (e.g. ["fraud detection", "personalization"])
    automated_decision_making: Whether processing involves automated decisions affecting individuals
    large_scale: Whether processing is conducted on a large scale
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: processing_description (required), data_categories (required), data_subjects (required), processing_purposes (required),… Returns: result

crosswalk_to_eu_ai_actA

Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously.

Args:
    gdpr_articles: Specific GDPR articles to map (or all if omitted)
    focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk"
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: gdpr_articles, focus_area, caller, tier, +1 more. Returns: result

dpia_generatorA

Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins.

Args:
    system_name: Name of the AI system or processing operation
    system_description: Detailed description of the system and its processing
    processing_purposes: Specific purposes of the processing
    data_categories: Types of personal data processed
    data_subjects: Categories of data subjects
    data_volume: Approximate volume (e.g., "10,000 records", "1M users")
    retention_period: How long data is retained (e.g., "2 years", "model lifetime")
    third_party_sharing: Whether data is shared with third parties
    international_transfers: Whether data is transferred outside the EEA
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: system_name (required), system_description (required), processing_purposes (required), data_categories (required), +8 mor… Returns: result

lawful_basis_assessmentA

Determine the appropriate lawful basis for processing under GDPR Article 6. Evaluates all 6 lawful bases with AI-specific considerations and recommends the most appropriate basis with supporting rationale.

Args:
    processing_purpose: The specific purpose of data processing
    data_categories: Types of personal data involved
    controller_type: "private" (company), "public" (government/public body)
    relationship_with_data_subject: Nature of relationship (customer/employee/patient/citizen/visitor)
    ai_processing: Whether an AI/ML system is used in processing
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: processing_purpose (required), data_categories (required), controller_type, relationship_with_data_subject, +4 more. Returns: result

rights_request_handlerA

Handle data subject rights requests under GDPR Articles 15-22. Provides step-by-step guidance for responding to access, rectification, erasure, restriction, portability, objection, and automated decision-making requests with AI-specific considerations.

Args:
    right_invoked: Which right is being exercised: "access", "rectification", "erasure", "restriction", "portability", "objection", "automated_decision"
    data_subject_description: Description of the requesting data subject
    processing_context: Context of the data processing involved
    ai_system_involved: Whether an AI system processed the data subject's data
    request_details: Specific details of the request
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Inputs: right_invoked (required), data_subject_description (required), processing_context (required), ai_system_involved, +4 more. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.1/5.0

    Scored across 6 tools

    Disambiguation5/5

    Each tool addresses a distinct GDPR compliance area (breach notification, processing classification, lawful basis, DPIA, rights requests, and EU AI Act mapping) with no overlap in purpose or functionality.

    Naming Consistency5/5

    All tool names follow a consistent descriptive_pattern (noun_verb or adjective_noun) using snake_case, e.g., breach_notification, classify_processing, dpia_generator.

    Tool Count5/5

    With 6 tools, the server covers the essential GDPR compliance tasks for AI systems without being too sparse or overly numerous. The count feels well-scoped for the domain.

    Completeness4/5

    The tool set covers major AI-relevant GDPR areas (DPIA, lawful basis, rights, breach, and crosswalk to AI Act). Minor gaps exist, such as tools for consent management or records of processing activities, but these are less critical for the stated purpose.

    Maintenance

    ActivitySlowing
    ResponsivenessMostly unanswered

    Resources

    Related MCP Connectors

    Related MCP Servers

    • EU AI Act Compliance MCP

      SonnyLabs
      A
      license
      A
      quality
      D
      maintenance
      Provides automated EU AI Act compliance tools, including risk classification, role determination, transparency disclosures, content watermarking, deepfake labeling, and security threat detection.
      16
      33
      Apache 2.0

    • conformite-ia-mcp

      AgentIA1984-cmd
      F
      license
      Not graded
      quality
      D
      maintenance
      Provides an AI agent with regulatory compliance tools for the French/European market based on the AI Act and GDPR, including system classification, obligation listing, deadline schedules, legal reference lookup, and GDPR crosschecks.
      -