classify_processing

Instructions

Args:
    processing_description: Description of the data processing activity
    data_categories: Types of personal data processed (e.g. ["name", "email", "biometric", "health"])
    data_subjects: Categories of data subjects (e.g. ["employees", "customers", "children"])
    processing_purposes: Purposes of processing (e.g. ["fraud detection", "personalization"])
    automated_decision_making: Whether processing involves automated decisions affecting individuals
    large_scale: Whether processing is conducted on a large scale
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)

Implementation Reference

• server.py:328-431 (handler)

  The `classify_processing` function is the main handler for the tool. It takes a processing description, data categories, data subjects, processing purposes, and flags for automated decision-making and large scale. It checks access via API key, performs rate limiting, then classifies the GDPR processing activity — determining DPIA triggers, applicable GDPR articles, risk level, and obligations (record-keeping, DPO, privacy notice, consent, human review, international transfer checks). Returns a structured classification result.

  # ---------------------------------------------------------------------------
  @mcp.tool()
  def classify_processing(
      processing_description: str,
      data_categories: list[str],
      data_subjects: list[str],
      processing_purposes: list[str],
      automated_decision_making: bool = False,
      large_scale: bool = False,
      caller: str = "anonymous",
      tier: str = "free", api_key: str = "") -> str:
      """Classify data processing activities per GDPR articles. Determines which
      GDPR articles apply, whether a DPIA is required, special category processing
      status, and automated decision-making obligations.
  
      Args:
          processing_description: Description of the data processing activity
          data_categories: Types of personal data processed (e.g. ["name", "email", "biometric", "health"])
          data_subjects: Categories of data subjects (e.g. ["employees", "customers", "children"])
          processing_purposes: Purposes of processing (e.g. ["fraud detection", "personalization"])
          automated_decision_making: Whether processing involves automated decisions affecting individuals
          large_scale: Whether processing is conducted on a large scale
          caller: Caller identifier for rate limiting
          tier: Access tier (free/pro)
      """
      allowed, msg, tier = check_access(api_key)
      if not allowed:
          return {"error": msg, "upgrade_url": "https://meok.ai/pricing"}
      if err := _check_rate_limit(caller, tier):
          return {"error": err}
  
      special_categories = {"racial or ethnic origin", "political opinions", "religious beliefs",
                           "philosophical beliefs", "trade union membership", "genetic data",
                           "biometric", "health", "sex life", "sexual orientation"}
  
      data_lower = [d.lower() for d in data_categories]
      has_special = any(any(sc in dl for sc in special_categories) for dl in data_lower)
      has_children = any("child" in ds.lower() or "minor" in ds.lower() for ds in data_subjects)
  
      # Determine DPIA requirement (Article 35)
      dpia_triggers = []
      if automated_decision_making:
          dpia_triggers.append("Systematic and extensive automated evaluation (Art.35(3)(a))")
      if has_special and large_scale:
          dpia_triggers.append("Large-scale processing of special categories (Art.35(3)(b))")
      if large_scale and any(w in processing_description.lower() for w in ["monitor", "surveillance", "tracking", "profiling"]):
          dpia_triggers.append("Systematic monitoring on a large scale (Art.35(3)(c))")
      if any(w in processing_description.lower() for w in ["ai", "machine learning", "neural", "model", "algorithm"]):
          dpia_triggers.append("New technology likely to result in high risk (EDPB guidance)")
  
      # Determine applicable articles
      applicable_articles = ["Art.5 (Processing principles)", "Art.6 (Lawful basis)"]
      if has_special:
          applicable_articles.append("Art.9 (Special categories)")
      applicable_articles.append("Art.13/14 (Transparency)")
      if automated_decision_making:
          applicable_articles.append("Art.22 (Automated decision-making)")
      applicable_articles.append("Art.25 (Data protection by design)")
      if dpia_triggers:
          applicable_articles.append("Art.35 (DPIA required)")
      if has_children:
          applicable_articles.append("Art.8 (Child's consent)")
  
      # Risk classification
      risk_factors = sum([has_special, has_children, automated_decision_making, large_scale, bool(dpia_triggers)])
      if risk_factors >= 4:
          risk_level = "VERY HIGH"
      elif risk_factors >= 3:
          risk_level = "HIGH"
      elif risk_factors >= 2:
          risk_level = "MEDIUM"
      else:
          risk_level = "LOW"
  
      result = {
          "classification_type": "GDPR Processing Activity Classification",
          "timestamp": datetime.now(timezone.utc).isoformat(),
          "processing": {
              "description": processing_description,
              "data_categories": data_categories,
              "data_subjects": data_subjects,
              "purposes": processing_purposes,
          },
          "classification": {
              "special_category_data": has_special,
              "children_data": has_children,
              "automated_decision_making": automated_decision_making,
              "large_scale": large_scale,
              "risk_level": risk_level,
          },
          "applicable_articles": applicable_articles,
          "dpia_required": len(dpia_triggers) > 0,
          "dpia_triggers": dpia_triggers,
          "obligations": {
              "record_of_processing": "Required (Art.30) — maintain records of processing activities",
              "dpo_required": has_special or large_scale,
              "privacy_notice": "Required (Art.13/14) — must inform data subjects before processing",
              "consent_mechanism": "Required if consent is the lawful basis — must be freely given, specific, informed, unambiguous",
              "human_review": automated_decision_making,
              "international_transfer_check": "Review required if data leaves EEA",
          },
      }
  
      return result

• server.py:329-338 (registration)

  The tool is registered via the `@mcp.tool()` decorator on line 329, which registers `classify_processing` as a FastMCP tool on the `mcp` server instance.

  @mcp.tool()
  def classify_processing(
      processing_description: str,
      data_categories: list[str],
      data_subjects: list[str],
      processing_purposes: list[str],
      automated_decision_making: bool = False,
      large_scale: bool = False,
      caller: str = "anonymous",
      tier: str = "free", api_key: str = "") -> str:

• server.py:330-338 (schema)

  The function signature defines the input schema: `processing_description` (str), `data_categories` (list[str]), `data_subjects` (list[str]), `processing_purposes` (list[str]), `automated_decision_making` (bool), `large_scale` (bool), and auth parameters. The docstring describes all parameters. The return type is `str` (actually returns a dict).

  def classify_processing(
      processing_description: str,
      data_categories: list[str],
      data_subjects: list[str],
      processing_purposes: list[str],
      automated_decision_making: bool = False,
      large_scale: bool = False,
      caller: str = "anonymous",
      tier: str = "free", api_key: str = "") -> str: