dpia_generator
Generate a Data Protection Impact Assessment (DPIA) with necessity assessment, risk evaluation, and mitigation measures to comply with GDPR Article 35 before starting high-risk AI processing.
Instructions
Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins.
Args:
system_name: Name of the AI system or processing operation
system_description: Detailed description of the system and its processing
processing_purposes: Specific purposes of the processing
data_categories: Types of personal data processed
data_subjects: Categories of data subjects
data_volume: Approximate volume (e.g., "10,000 records", "1M users")
retention_period: How long data is retained (e.g., "2 years", "model lifetime")
third_party_sharing: Whether data is shared with third parties
international_transfers: Whether data is transferred outside the EEA
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| system_name | Yes | ||
| system_description | Yes | ||
| processing_purposes | Yes | ||
| data_categories | Yes | ||
| data_subjects | Yes | ||
| data_volume | No | unknown | |
| retention_period | No | unknown | |
| third_party_sharing | No | ||
| international_transfers | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- server.py:572-728 (handler)The dpia_generator tool handler function. It generates a Data Protection Impact Assessment (DPIA) per GDPR Article 35. Takes system metadata (name, description, purposes, data categories, data subjects, volume, retention, third-party sharing, international transfers) and returns a structured DPIA with necessity assessment, risk evaluation, and mitigation measures.
# --------------------------------------------------------------------------- # TOOL 3: DPIA Generator # --------------------------------------------------------------------------- @mcp.tool() def dpia_generator( system_name: str, system_description: str, processing_purposes: list[str], data_categories: list[str], data_subjects: list[str], data_volume: str = "unknown", retention_period: str = "unknown", third_party_sharing: bool = False, international_transfers: bool = False, caller: str = "anonymous", tier: str = "free", api_key: str = "") -> str: """Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins. Args: system_name: Name of the AI system or processing operation system_description: Detailed description of the system and its processing processing_purposes: Specific purposes of the processing data_categories: Types of personal data processed data_subjects: Categories of data subjects data_volume: Approximate volume (e.g., "10,000 records", "1M users") retention_period: How long data is retained (e.g., "2 years", "model lifetime") third_party_sharing: Whether data is shared with third parties international_transfers: Whether data is transferred outside the EEA caller: Caller identifier for rate limiting tier: Access tier (free/pro) """ allowed, msg, tier = check_access(api_key) if not allowed: return {"error": msg, "upgrade_url": "https://meok.ai/pricing"} if err := _check_rate_limit(caller, tier): return {"error": err} desc_lower = system_description.lower() is_ai = any(w in desc_lower for w in ["ai", "machine learning", "neural", "model", "algorithm", "automated"]) special_categories = {"biometric", "health", "genetic", "racial", "ethnic", "political", "religious", "sex life", "sexual orientation"} has_special = any(any(sc in d.lower() for sc in special_categories) for d in data_categories) # Risk assessment risks = [] risk_score = 0 risk_checks = [ (is_ai, 3, "Automated processing/AI system", "HIGH", "Implement human oversight mechanisms, explainability features, regular bias audits"), (has_special, 4, "Special category data processing", "VERY HIGH", "Apply Article 9(2) exception, encrypt at rest and in transit, implement strict access controls"), (any("child" in ds.lower() for ds in data_subjects), 4, "Processing of children's data", "VERY HIGH", "Age verification, parental consent mechanisms, enhanced safeguards"), (third_party_sharing, 2, "Third-party data sharing", "MEDIUM", "Data processing agreements, due diligence on recipients, contractual safeguards"), (international_transfers, 3, "International data transfers outside EEA", "HIGH", "Standard Contractual Clauses, adequacy decisions, Transfer Impact Assessments"), ("profiling" in desc_lower or "scoring" in desc_lower, 3, "Profiling or scoring individuals", "HIGH", "Right to object mechanism, human review option, transparency about profiling logic"), ("large scale" in desc_lower or "1m" in data_volume.lower() or "million" in data_volume.lower(), 2, "Large-scale processing", "MEDIUM", "Data minimisation review, purpose limitation enforcement, enhanced security"), ] for condition, score, risk_name, level, mitigation in risk_checks: if condition: risk_score += score risks.append({"risk": risk_name, "level": level, "mitigation": mitigation}) if risk_score >= 15: overall_risk = "VERY HIGH" elif risk_score >= 10: overall_risk = "HIGH" elif risk_score >= 5: overall_risk = "MEDIUM" else: overall_risk = "LOW" dpia = { "document_type": "Data Protection Impact Assessment (DPIA)", "legal_basis": "GDPR Article 35", "timestamp": datetime.now(timezone.utc).isoformat(), "version": "1.0", "section_1_description": { "system_name": system_name, "system_description": system_description, "processing_purposes": processing_purposes, "data_categories": data_categories, "data_subjects": data_subjects, "data_volume": data_volume, "retention_period": retention_period, "third_party_sharing": third_party_sharing, "international_transfers": international_transfers, "automated_processing": is_ai, }, "section_2_necessity_and_proportionality": { "purpose_legitimate": "Assessment required — controller must demonstrate specific, explicit, legitimate purpose", "data_minimisation": "Assessment required — verify all data categories are necessary for stated purposes", "retention_justified": f"Stated retention: {retention_period} — must demonstrate necessity for this duration", "data_subject_informed": "Privacy notice required under Articles 13/14 including AI-specific transparency", "lawful_basis_identified": "Must identify and document lawful basis under Article 6 (and Article 9 if special categories)", }, "section_3_risk_assessment": { "overall_risk_level": overall_risk, "risk_score": risk_score, "identified_risks": risks, "rights_and_freedoms_impact": [ "Right to privacy (Article 7 EU Charter)", "Right to data protection (Article 8 EU Charter)", "Right to non-discrimination (Article 21 EU Charter)" if has_special else None, "Right not to be subject to automated decisions (GDPR Art.22)" if is_ai else None, "Rights of the child (Article 24 EU Charter)" if any("child" in ds.lower() for ds in data_subjects) else None, ], }, "section_4_mitigation_measures": { "technical_measures": [ "Encryption at rest and in transit (AES-256, TLS 1.3)", "Access control and authentication (RBAC, MFA)", "Pseudonymisation or anonymisation where feasible", "Regular security testing and vulnerability assessments", "Audit logging of all data access and processing operations", "Differential privacy in AI training" if is_ai else None, "Model explainability tools (SHAP, LIME)" if is_ai else None, "Bias detection and monitoring" if is_ai else None, ], "organisational_measures": [ "Data protection training for all personnel", "Data Processing Agreements with all processors", "Data breach response procedures (72-hour notification)", "Regular DPIA reviews (at least annually)", "Data Protection Officer oversight", "Human-in-the-loop for high-stakes AI decisions" if is_ai else None, ], }, "section_5_consultation": { "dpo_consulted": "Required — DPO must be consulted during DPIA", "supervisory_authority": "Prior consultation required if residual risk remains HIGH after mitigations (Art.36)", "data_subjects_views": "Should seek views of data subjects or their representatives where appropriate", }, "section_6_decision": { "proceed_with_processing": overall_risk in ("LOW", "MEDIUM"), "conditions": ( "Processing may proceed with identified mitigations in place" if overall_risk in ("LOW", "MEDIUM") else "Processing should NOT proceed until residual risk is reduced. Consider prior consultation with supervisory authority (Art.36)" ), "review_date": "Review within 12 months or upon significant change to processing", }, } # Clean None values from lists dpia["section_3_risk_assessment"]["rights_and_freedoms_impact"] = [ r for r in dpia["section_3_risk_assessment"]["rights_and_freedoms_impact"] if r ] dpia["section_4_mitigation_measures"]["technical_measures"] = [ m for m in dpia["section_4_mitigation_measures"]["technical_measures"] if m ] dpia["section_4_mitigation_measures"]["organisational_measures"] = [ m for m in dpia["section_4_mitigation_measures"]["organisational_measures"] if m ] return dpia - server.py:575-604 (schema)Function signature/input schema for dpia_generator: system_name, system_description, processing_purposes (list), data_categories (list), data_subjects (list), data_volume, retention_period, third_party_sharing (bool), international_transfers (bool), caller, tier, api_key.
@mcp.tool() def dpia_generator( system_name: str, system_description: str, processing_purposes: list[str], data_categories: list[str], data_subjects: list[str], data_volume: str = "unknown", retention_period: str = "unknown", third_party_sharing: bool = False, international_transfers: bool = False, caller: str = "anonymous", tier: str = "free", api_key: str = "") -> str: """Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins. Args: system_name: Name of the AI system or processing operation system_description: Detailed description of the system and its processing processing_purposes: Specific purposes of the processing data_categories: Types of personal data processed data_subjects: Categories of data subjects data_volume: Approximate volume (e.g., "10,000 records", "1M users") retention_period: How long data is retained (e.g., "2 years", "model lifetime") third_party_sharing: Whether data is shared with third parties international_transfers: Whether data is transferred outside the EEA caller: Caller identifier for rate limiting tier: Access tier (free/pro) """ - server.py:573-574 (registration)The @mcp.tool() decorator that registers dpia_generator as an MCP tool on the FastMCP server instance.
# TOOL 3: DPIA Generator # --------------------------------------------------------------------------- - server.py:587-604 (helper)Authentication (check_access) and rate limiting (_check_rate_limit) at the start of the dpia_generator function, reused across all tools.
tier: str = "free", api_key: str = "") -> str: """Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins. Args: system_name: Name of the AI system or processing operation system_description: Detailed description of the system and its processing processing_purposes: Specific purposes of the processing data_categories: Types of personal data processed data_subjects: Categories of data subjects data_volume: Approximate volume (e.g., "10,000 records", "1M users") retention_period: How long data is retained (e.g., "2 years", "model lifetime") third_party_sharing: Whether data is shared with third parties international_transfers: Whether data is transferred outside the EEA caller: Caller identifier for rate limiting tier: Access tier (free/pro) """