GDPR Compliance for AI Systems MCP Server
GDPR 合规性 MCP
针对 AI/ML 系统的完整 GDPR 合规性评估。
合法性基础(第 6 条)· DPIA(第 35 条)· 数据主体权利(第 15-22 条)· 数据泄露通知(72 小时规则)· 欧盟《人工智能法案》交叉比对
处罚:最高可达全球营业额的 4% 或 2000 万欧元。
为什么存在此工具
每个处理个人数据的 AI 系统都需要符合 GDPR。第 35 条要求对高风险处理进行 DPIA(数据保护影响评估)——这包括大多数基于个人数据的机器学习训练。第 22 条限制了自动化决策。72 小时的泄露通知窗口不容许任何手动流程。
此 MCP 实现了 GDPR 评估的自动化:分类处理活动、确定合法性基础、生成 DPIA、检查数据主体权利工作流,并将评估结果与欧盟《人工智能法案》的义务进行交叉比对。
Related MCP server: conformite-ia-mcp
安装
pip install gdpr-compliance-ai-mcp工具
工具 | GDPR 条款 | 功能 |
| 第 4, 6 条 | 处理活动分类 + 合法性基础 |
| 第 35 条 | 数据保护影响评估生成器 |
| 第 15-22 条 | 数据主体权利工作流审计 |
| 第 33-34 条 | 72 小时泄露通知准备情况 |
| 第 22 条 | 自动化决策合规性 |
| — | GDPR 与欧盟《人工智能法案》义务映射 |
| 全部 | 完整的 GDPR 就绪情况评估 |
| — | HMAC-SHA256 签名的合规证书 |
定价
层级 | 价格 | 包含内容 |
免费版 | £0 | 每天 10 次调用 |
专业版 | £199/月 | 无限制 + HMAC 签名认证 |
企业版 | £1,499/月 | 多租户 + 联合品牌报告 |
认证 API
POST https://meok-attestation-api.vercel.app/sign
GET https://meok-attestation-api.vercel.app/verify/{cert_id}链接
网站: meok.ai
所有 MCP 服务器: meok.ai/labs/mcp/servers
企业支持: nicholas@csoai.org
许可证
MIT
Available Tools
6 toolsbreach_notificationA
Assess breach severity and notification requirements under GDPR Articles 33-34 (72-hour rule). Determines whether supervisory authority and data subject notification is required, and generates the notification content.
Args:
breach_description: Description of the personal data breach
data_categories_affected: Types of personal data affected
number_of_records: Approximate number of records/individuals affected
breach_type: Type of breach: "confidentiality" (unauthorized access), "integrity" (unauthorized alteration), "availability" (unauthorized loss of access)
detection_timestamp: When the breach was detected (ISO format, or "now")
ai_system_involved: Whether an AI system was involved in the breach
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| breach_description | Yes | ||
| data_categories_affected | Yes | ||
| number_of_records | No | ||
| breach_type | No | confidentiality | |
| detection_timestamp | No | ||
| ai_system_involved | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
classify_processingA
Classify data processing activities per GDPR articles. Determines which GDPR articles apply, whether a DPIA is required, special category processing status, and automated decision-making obligations.
Args:
processing_description: Description of the data processing activity
data_categories: Types of personal data processed (e.g. ["name", "email", "biometric", "health"])
data_subjects: Categories of data subjects (e.g. ["employees", "customers", "children"])
processing_purposes: Purposes of processing (e.g. ["fraud detection", "personalization"])
automated_decision_making: Whether processing involves automated decisions affecting individuals
large_scale: Whether processing is conducted on a large scale
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| processing_description | Yes | ||
| data_categories | Yes | ||
| data_subjects | Yes | ||
| processing_purposes | Yes | ||
| automated_decision_making | No | ||
| large_scale | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
crosswalk_to_eu_ai_actA
Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously.
Args:
gdpr_articles: Specific GDPR articles to map (or all if omitted)
focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk"
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| gdpr_articles | No | ||
| focus_area | No | all | |
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
dpia_generatorA
Generate a Data Protection Impact Assessment per GDPR Article 35. Produces a structured DPIA with necessity assessment, risk evaluation, and mitigation measures. Required before high-risk AI processing begins.
Args:
system_name: Name of the AI system or processing operation
system_description: Detailed description of the system and its processing
processing_purposes: Specific purposes of the processing
data_categories: Types of personal data processed
data_subjects: Categories of data subjects
data_volume: Approximate volume (e.g., "10,000 records", "1M users")
retention_period: How long data is retained (e.g., "2 years", "model lifetime")
third_party_sharing: Whether data is shared with third parties
international_transfers: Whether data is transferred outside the EEA
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| system_name | Yes | ||
| system_description | Yes | ||
| processing_purposes | Yes | ||
| data_categories | Yes | ||
| data_subjects | Yes | ||
| data_volume | No | unknown | |
| retention_period | No | unknown | |
| third_party_sharing | No | ||
| international_transfers | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
lawful_basis_assessmentA
Determine the appropriate lawful basis for processing under GDPR Article 6. Evaluates all 6 lawful bases with AI-specific considerations and recommends the most appropriate basis with supporting rationale.
Args:
processing_purpose: The specific purpose of data processing
data_categories: Types of personal data involved
controller_type: "private" (company), "public" (government/public body)
relationship_with_data_subject: Nature of relationship (customer/employee/patient/citizen/visitor)
ai_processing: Whether an AI/ML system is used in processing
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| processing_purpose | Yes | ||
| data_categories | Yes | ||
| controller_type | No | private | |
| relationship_with_data_subject | No | customer | |
| ai_processing | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
rights_request_handlerA
Handle data subject rights requests under GDPR Articles 15-22. Provides step-by-step guidance for responding to access, rectification, erasure, restriction, portability, objection, and automated decision-making requests with AI-specific considerations.
Args:
right_invoked: Which right is being exercised: "access", "rectification", "erasure", "restriction", "portability", "objection", "automated_decision"
data_subject_description: Description of the requesting data subject
processing_context: Context of the data processing involved
ai_system_involved: Whether an AI system processed the data subject's data
request_details: Specific details of the request
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)
| Name | Required | Description | Default |
|---|---|---|---|
| right_invoked | Yes | ||
| data_subject_description | Yes | ||
| processing_context | Yes | ||
| ai_system_involved | No | ||
| request_details | No | ||
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
breach_notification - First observed
classify_processing - First observed
crosswalk_to_eu_ai_act - First observed
dpia_generator - First observed
lawful_basis_assessment - First observed
rights_request_handler
TDQS
Scored across 6 tools
Each tool addresses a distinct GDPR compliance area (breach notification, processing classification, lawful basis, DPIA, rights requests, and EU AI Act mapping) with no overlap in purpose or functionality.
All tool names follow a consistent descriptive_pattern (noun_verb or adjective_noun) using snake_case, e.g., breach_notification, classify_processing, dpia_generator.
With 6 tools, the server covers the essential GDPR compliance tasks for AI systems without being too sparse or overly numerous. The count feels well-scoped for the domain.
The tool set covers major AI-relevant GDPR areas (DPIA, lawful basis, rights, breach, and crosswalk to AI Act). Minor gaps exist, such as tools for consent management or records of processing activities, but these are less critical for the stated purpose.
Maintenance
Related MCP Connectors
EU AI Act and GDPR checks with sources: classify an AI system, trace each duty, find the supervisor.
GDPR & privacy compliance: records of processing, data breaches, DSRs, risks, audits, AI systems.
AI inventory and EU AI Act compliance. Find AI tools and use cases, check new AI uses before launch.
Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.
Related MCP Servers
- AlicenseAqualityDmaintenanceProvides automated EU AI Act compliance tools, including risk classification, role determination, transparency disclosures, content watermarking, deepfake labeling, and security threat detection.1633Apache 2.0
- FlicenseNot gradedqualityDmaintenanceProvides an AI agent with regulatory compliance tools for the French/European market based on the AI Act and GDPR, including system classification, obligation listing, deadline schedules, legal reference lookup, and GDPR crosschecks.-
- AlicenseNot gradedqualityDmaintenanceEnables EU AI Act compliance for AI agent systems by providing risk classification, audit trails, gap analysis, and evidence package generation.51 npmMIT
- AlicenseNot gradedqualityDmaintenanceEnables AI impact assessments according to ISO/IEC 42005:2025, with built-in EU AI Act compliance and support for phases, categories, and assessment operations.30 PyPIMIT