io.github.CSOAI-ORG/dataprivacy-ai-mcp

Classify data fields as personal, special category, or anonymous per GDPR. Analyses a list of data field names and classifies each according to GDPR Article 4 (personal data), Article 9 (special category data), and Article 10 (criminal offence data). Args: fields: List of data field names to classify (e.g. ["email", "health_data", "company_name", "date_of_birth"]). context: Optional context about how the data is used (affects classification of borderline cases like photographs or IP addresses). Returns: Classification of each field with GDPR article references and risk level. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.

Determine appropriate lawful basis for processing personal data. Evaluates the six lawful bases under GDPR Article 6 and recommends the most appropriate basis for the described processing activity. Args: processing_purpose: Description of why data is being processed (e.g. "sending marketing emails", "processing payroll", "fraud detection"). data_types: Types of data being processed (e.g. ["email", "name", "purchase_history"]). data_subjects: Who the data subjects are (e.g. "customers", "employees", "website_visitors"). is_public_authority: Whether the controller is a public authority. existing_relationship: Whether there is an existing relationship with data subjects. involves_children: Whether processing involves children's data. Returns: Recommended lawful basis with justification, alternatives, and requirements. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.

Generate a Data Protection Impact Assessment template per GDPR Article 35. A DPIA is mandatory when processing is likely to result in a high risk to individuals' rights and freedoms. This generates a structured DPIA template with risk assessment and mitigation measures. Args: project_name: Name of the project/system being assessed. processing_description: Description of the processing operation. data_types: Types of personal data processed (e.g. ["email", "health_data", "location"]). data_subjects: Categories of data subjects (e.g. "employees", "patients", "children"). purpose: Purpose of the processing. lawful_basis: Lawful basis under Article 6 (consent, contract, legal_obligation, vital_interests, public_task, legitimate_interests). automated_decision_making: Whether automated decision-making/profiling is involved. large_scale: Whether processing is on a large scale. systematic_monitoring: Whether systematic monitoring of public areas is involved. new_technology: Whether new/innovative technology is used. Returns: Complete DPIA template with risk assessment, necessity/proportionality analysis, and recommended mitigation measures. Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.

Assess legality of international personal data transfers under GDPR Chapter V. Evaluates whether a transfer to a non-UK/EU country is lawful by checking adequacy decisions, Standard Contractual Clauses, Binding Corporate Rules, and derogations. Args: destination_country: Country receiving the data (e.g. "United States", "India", "Australia"). transfer_mechanism: Proposed transfer mechanism: "adequacy", "sccs", "bcrs", "derogation_consent", "derogation_contract", "derogation_public_interest". If not provided, the tool will recommend appropriate mechanisms. data_types: Optional list of data types being transferred. recipient_type: Relationship with recipient: "processor" (acting on your instructions), "controller" (determines own purposes), "joint_controller". Returns: Transfer assessment with required safeguards and documentation. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.

Score a data breach severity and determine ICO notification requirements. Assesses whether a breach must be reported to the ICO (within 72 hours per Article 33) and/or to affected individuals (Article 34). Uses a risk-based scoring approach aligned with EDPB and ICO guidance. Args: data_types_affected: Types of data breached (e.g. ["email", "health_data", "credit_card"]). number_of_individuals: Number of data subjects affected. breach_type: Type of breach: "confidentiality" (unauthorised access/disclosure), "integrity" (unauthorised alteration), "availability" (loss of access/destruction). data_encrypted: Whether the breached data was encrypted. data_backed_up: Whether data can be restored from backups (for availability breaches). containment_time_hours: Time to contain the breach in hours. likely_consequences: Impact on individuals: "significant_harm" (identity theft, financial loss, discrimination), "some_impact" (inconvenience, distress), "minimal_impact" (unlikely to affect individuals). Returns: Breach severity score, ICO notification requirement, and response checklist. Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.

Generate an Article 13/14 compliant privacy notice. Creates a GDPR-compliant privacy notice covering all mandatory information required by Articles 13 (data collected from the individual) and 14 (data obtained from other sources). Args: controller_name: Name of the data controller (organisation). controller_contact: Contact details for the controller. dpo_contact: Data Protection Officer contact (required for public authorities and organisations processing special category data at scale). purposes: List of processing purposes (e.g. ["provide services", "send marketing", "fraud prevention"]). lawful_bases: Lawful bases for each purpose (e.g. ["contract", "consent", "legitimate_interests"]). data_categories: Types of personal data collected (e.g. ["name", "email", "payment_details"]). recipients: Categories of recipients data is shared with (e.g. ["payment processors", "delivery partners"]). international_transfers: Whether data is transferred outside UK/EEA. retention_period: How long data is retained (e.g. "6 years after last transaction"). automated_decisions: Whether automated decision-making/profiling is used. website_url: Website URL for the notice. Returns: Complete privacy notice text with all Article 13/14 mandatory sections. Behavior: This tool generates structured output without modifying external systems. Output is deterministic for identical inputs. No side effects. Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool for security assessment, threat detection, or vulnerability analysis. Suitable for automated security scanning and risk evaluation. When NOT to use: Do not rely solely on this tool for production security decisions. Always combine with manual security review.