Skip to main content
Glama
GDPR Compliance for AI Systems MCP Server

GDPR Compliance for AI Systems MCP Server

gdpr-compliance-ai-mcp MCP server MCP Registry PyPI

gdpr-compliance-ai-mcp MCP server

PyPI Downloads GitHub stars License: MIT

GDPR 合规性 MCP

针对 AI/ML 系统的完整 GDPR 合规性评估。

合法性基础(第 6 条)· DPIA(第 35 条)· 数据主体权利(第 15-22 条)· 数据泄露通知(72 小时规则)· 欧盟《人工智能法案》交叉比对

处罚:最高可达全球营业额的 4% 或 2000 万欧元。

MEOK AI Labs

安装 · 工具 · 定价


为什么存在此工具

每个处理个人数据的 AI 系统都需要符合 GDPR。第 35 条要求对高风险处理进行 DPIA(数据保护影响评估)——这包括大多数基于个人数据的机器学习训练。第 22 条限制了自动化决策。72 小时的泄露通知窗口不容许任何手动流程。

此 MCP 实现了 GDPR 评估的自动化:分类处理活动、确定合法性基础、生成 DPIA、检查数据主体权利工作流,并将评估结果与欧盟《人工智能法案》的义务进行交叉比对。

Related MCP server: conformite-ia-mcp

安装

pip install gdpr-compliance-ai-mcp

工具

工具

GDPR 条款

功能

classify_processing

第 4, 6 条

处理活动分类 + 合法性基础

generate_dpia

第 35 条

数据保护影响评估生成器

check_data_rights

第 15-22 条

数据主体权利工作流审计

assess_breach_process

第 33-34 条

72 小时泄露通知准备情况

check_automated_decisions

第 22 条

自动化决策合规性

crosswalk_eu_ai_act

—

GDPR 与欧盟《人工智能法案》义务映射

run_full_audit

全部

完整的 GDPR 就绪情况评估

sign_attestation

—

HMAC-SHA256 签名的合规证书

定价

层级

价格

包含内容

免费版

£0

每天 10 次调用

专业版

£199/月

无限制 + HMAC 签名认证

企业版

£1,499/月

多租户 + 联合品牌报告

订阅专业版 · 企业版

认证 API

POST https://meok-attestation-api.vercel.app/sign
GET  https://meok-attestation-api.vercel.app/verify/{cert_id}

链接

许可证

MIT

Available Tools

6 tools
breach_notificationA

Assess breach severity and notification requirements under GDPR Articles 33-34 (72-hour rule). Determines whether supervisory authority and data subject notification is required, and generates the notification content.

Args:
    breach_description: Description of the personal data breach
    data_categories_affected: Types of personal data affected
    number_of_records: Approximate number of records/individuals affected
    breach_type: Type of breach: "confidentiality" (unauthorized access), "integrity" (unauthorized alteration), "availability" (unauthorized loss of access)
    detection_timestamp: When the breach was detected (ISO format, or "now")
    ai_system_involved: Whether an AI system was involved in the breach
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
breach_descriptionYes
data_categories_affectedYes
number_of_recordsNo
breach_typeNoconfidentiality
detection_timestampNo
ai_system_involvedNo
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes
classify_processingA

Classify data processing activities per GDPR articles. Determines which GDPR articles apply, whether a DPIA is required, special category processing status, and automated decision-making obligations.

Args:
    processing_description: Description of the data processing activity
    data_categories: Types of personal data processed (e.g. ["name", "email", "biometric", "health"])
    data_subjects: Categories of data subjects (e.g. ["employees", "customers", "children"])
    processing_purposes: Purposes of processing (e.g. ["fraud detection", "personalization"])
    automated_decision_making: Whether processing involves automated decisions affecting individuals
    large_scale: Whether processing is conducted on a large scale
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
processing_descriptionYes
data_categoriesYes
data_subjectsYes
processing_purposesYes
automated_decision_makingNo
large_scaleNo
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes
crosswalk_to_eu_ai_actA

Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously.

Args:
    gdpr_articles: Specific GDPR articles to map (or all if omitted)
    focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk"
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
gdpr_articlesNo
focus_areaNoall
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes
dpia_generatorA

Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins.

Args:
    system_name: Name of the AI system or processing operation
    system_description: Detailed description of the system and its processing
    processing_purposes: Specific purposes of the processing
    data_categories: Types of personal data processed
    data_subjects: Categories of data subjects
    data_volume: Approximate volume (e.g., "10,000 records", "1M users")
    retention_period: How long data is retained (e.g., "2 years", "model lifetime")
    third_party_sharing: Whether data is shared with third parties
    international_transfers: Whether data is transferred outside the EEA
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
system_nameYes
system_descriptionYes
processing_purposesYes
data_categoriesYes
data_subjectsYes
data_volumeNounknown
retention_periodNounknown
third_party_sharingNo
international_transfersNo
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes
lawful_basis_assessmentA

Determine the appropriate lawful basis for processing under GDPR Article 6. Evaluates all 6 lawful bases with AI-specific considerations and recommends the most appropriate basis with supporting rationale.

Args:
    processing_purpose: The specific purpose of data processing
    data_categories: Types of personal data involved
    controller_type: "private" (company), "public" (government/public body)
    relationship_with_data_subject: Nature of relationship (customer/employee/patient/citizen/visitor)
    ai_processing: Whether an AI/ML system is used in processing
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
processing_purposeYes
data_categoriesYes
controller_typeNoprivate
relationship_with_data_subjectNocustomer
ai_processingNo
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes
rights_request_handlerA

Handle data subject rights requests under GDPR Articles 15-22. Provides step-by-step guidance for responding to access, rectification, erasure, restriction, portability, objection, and automated decision-making requests with AI-specific considerations.

Args:
    right_invoked: Which right is being exercised: "access", "rectification", "erasure", "restriction", "portability", "objection", "automated_decision"
    data_subject_description: Description of the requesting data subject
    processing_context: Context of the data processing involved
    ai_system_involved: Whether an AI system processed the data subject's data
    request_details: Specific details of the request
    caller: Caller identifier for rate limiting
    tier: Access tier (free/pro)
NameRequiredDescriptionDefault
right_invokedYes
data_subject_descriptionYes
processing_contextYes
ai_system_involvedNo
request_detailsNo
callerNoanonymous
tierNofree
api_keyNo

Output Schema

NameRequiredDescription
resultYes

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.1.0
    • First observedbreach_notification
    • First observedclassify_processing
    • First observedcrosswalk_to_eu_ai_act
    • First observeddpia_generator
    • First observedlawful_basis_assessment
    • First observedrights_request_handler

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation5/5

Each tool addresses a distinct GDPR compliance area (breach notification, processing classification, lawful basis, DPIA, rights requests, and EU AI Act mapping) with no overlap in purpose or functionality.

Naming Consistency5/5

All tool names follow a consistent descriptive_pattern (noun_verb or adjective_noun) using snake_case, e.g., breach_notification, classify_processing, dpia_generator.

Tool Count5/5

With 6 tools, the server covers the essential GDPR compliance tasks for AI systems without being too sparse or overly numerous. The count feels well-scoped for the domain.

Completeness4/5

The tool set covers major AI-relevant GDPR areas (DPIA, lawful basis, rights, breach, and crosswalk to AI Act). Minor gaps exist, such as tools for consent management or records of processing activities, but these are less critical for the stated purpose.

Maintenance

ActivitySlowing
ResponsivenessMostly unanswered

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Provides automated EU AI Act compliance tools, including risk classification, role determination, transparency disclosures, content watermarking, deepfake labeling, and security threat detection.
    16
    33
    Apache 2.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    Provides an AI agent with regulatory compliance tools for the French/European market based on the AI Act and GDPR, including system classification, obligation listing, deadline schedules, legal reference lookup, and GDPR crosschecks.
    -