GDPR compliance with an AI assistant and MCP: what works, what does not

Which GDPR records an AI assistant can draft

An AI assistant such as Claude, ChatGPT or Copilot drafts from whatever you give it. Through MCP (Model Context Protocol), an open standard, it reads directly in programs that offer an MCP server, instead of you copying files into the chat.

The record of processing activities under Art. 30(1) GDPR contains, among other things, the purposes of the processing, the categories of data subjects and of personal data, and the categories of recipients. Where possible, it also holds erasure time limits and a general description of the technical and organisational measures (TOMs) under Art. 32. From a list of your processes and software, an assistant can lay out first entries.

It can compare a data processing agreement (DPA) with the points of Art. 28(3). These include instructions, confidentiality, the measures under Art. 32, and deletion or return at the end of the service.

It can structure a data protection impact assessment (DPIA), the assessment of a high-risk processing before it starts, along the minimum contents of Art. 35(7). From notes on a personal data breach it can prepare an entry with the facts, the effects and the remedial action, as Art. 33(5) requires.

Art. 28(3) · Art. 30(1) · Art. 33(5) · Art. 35(7) GDPR

What stays with the controller and the data protection officer

The controller is whoever determines the purposes and means of the processing (Art. 4(7) GDPR), which means your company. It is responsible for compliance with the principles in Art. 5(1) and must be able to demonstrate it (Art. 5(2)). A draft from an assistant changes none of that.

So your company decides whether measures are appropriate to the risk (Art. 32(1)). It chooses processors that provide sufficient guarantees (Art. 28(1)). It decides whether a processing needs a DPIA (Art. 35(1)) and whether a breach has to be notified (Art. 33(1)).

Where a data protection officer (DPO) is designated, they inform and advise, monitor compliance and give advice on the DPIA where requested (Art. 39(1)). An assistant can prepare work for them. The GDPR assigns the tasks themselves to the DPO.

Art. 4(7) · Art. 5(2) · Art. 39(1) GDPR

What nisd2.eu does here, and what it does not

nisd2.eu helps with your NIS 2 obligations. It does not cover your GDPR obligations. The NIS 2 walkthrough keeps no record of processing activities, no TOMs under Art. 32 GDPR, no DPIA and no documentation of personal data breaches.

The nisd2.eu MCP server gives an assistant access to the walkthrough's 21 items, with the rights of the person who connected it. The assistant can also read items that are already finished or approved, in the areas assigned to that person. If an admin lets assistants read the records and the person may export, it also reads the company's records as the export holds them, incidents and training participants included.

The assistant writes the GDPR draft outside the walkthrough, as an answer in the chat or as a file. You file it wherever your company keeps its data protection records. The walkthrough has no screen for it.

Which walkthrough entries help

In 2.2 you record what your company does every day, such as “HR and payroll administration”, and which software you use from which vendor. In our reading, processing activities can be derived from these processes. Which personal data a process handles, however, is not on the list.

The list in 5.1 names each supplier with what it does for you. Whether it processes personal data on your behalf and is therefore a processor (Art. 4(8) GDPR) is not something the screen asks. You check that for each one.

The incident response plan in 3.1 says that if personal data is affected, you also notify the data protection authority unless a risk is unlikely (Art. 33 GDPR). The walkthrough has no place for the documentation under Art. 33(5).

Art. 4(8) · Art. 33 GDPR