GDPR Compliance for AI Systems MCP Server

By MEOK AI Labs -- Sovereign AI tools for everyone.

Full GDPR compliance assessment for AI/ML systems. Classify processing activities, determine lawful basis (6 bases under Article 6), generate DPIAs (Article 35), handle data subject rights (Articles 15-22), assess breach notification (72-hour rule), and crosswalk to EU AI Act.

Part of the CSOAI Governance Suite: GDPR + EU AI Act + ISO 42001 + ISO 27001 + SOC 2.

Tools

Tool	Description
classify_processing	Classify data processing activities per GDPR articles
lawful_basis_assessment	Determine lawful basis (6 bases under Article 6)
dpia_generator	Generate Data Protection Impact Assessment (Article 35)
rights_request_handler	Handle data subject rights (Articles 15-22)
breach_notification	Assess breach severity and 72-hour notification requirements
crosswalk_to_eu_ai_act	Map GDPR requirements to EU AI Act obligations

Quick Start

pip install mcp
git clone https://github.com/CSOAI-ORG/gdpr-compliance-ai-mcp.git
cd gdpr-compliance-ai-mcp
python server.py

Claude Desktop Config

{
  "mcpServers": {
    "gdpr-compliance-ai": {
      "command": "python",
      "args": ["server.py"],
      "cwd": "/path/to/gdpr-compliance-ai-mcp"
    }
  }
}

Coverage

• 6 Lawful Bases (Article 6) with AI-specific assessment
• 8 Data Subject Rights (Articles 15-22) with response guidance
• DPIA Generation per Article 35 with risk scoring
• 72-Hour Breach Notification assessment (Articles 33-34)
• 9 GDPR-to-EU AI Act crosswalk mappings including the Article 9/10(5) tension
• AI-specific considerations throughout (training data, model memorization, automated decisions)

The Crosswalk Advantage

The crosswalk_to_eu_ai_act tool shows exactly where GDPR compliance satisfies EU AI Act requirements and where tension exists -- particularly the Article 9 special categories vs Article 10(5) bias monitoring pathway.

License

MIT -- see LICENSE