Your documents stay local
Processing activity descriptions contain the exact personal data details you're trying to protect. With Legalcode, those descriptions stay on your machine — your agent queries only the regulatory framework (GDPR provisions, EDPB guidance), not your organisation's data. No irony in uploading data processing descriptions to a cloud platform to assess privacy risk.
- Your agent works with your documents locally
- Searches are processed, never stored
- Combine Legalcode with your local files, tools, and workflows in one environment
- Works inside your existing AI agent — Claude Code, ChatGPT, Cursor, or any MCP client
How it works
- 1
Describe the processing activity to your local agent
Tell the agent what data is being processed, by whom, for what purpose, and in which jurisdictions. This description stays in your local session — Legalcode is queried only for the EDPB criteria and regulatory framework.
- 2
Skill applies EDPB screening criteria
The skill runs the European Data Protection Board's nine-criterion screening to determine whether a formal DPIA is mandatory, then proceeds with the structured assessment.
- 3
Risk matrix populated
The agent identifies risks to data subjects (likelihood × severity), maps them to the processing steps, and suggests technical and organisational measures to mitigate each risk.
- 4
DPIA document drafted
A complete DPIA document is generated in the required format — including processing description, lawful basis, necessity and proportionality analysis, risk assessment, and DPO consultation status.
What it produces
- DPIA necessity screening report (EDPB nine-criteria test)
- Processing activity description in Article 30 register format
- Risk matrix (likelihood × severity, per risk)
- Technical and organisational measures (TOMs) list
- Residual risk assessment
- Complete DPIA document ready for DPO review
Jurisdictions covered
Related workflows and skills
FAQ
- Does the skill cover UK GDPR as well as EU GDPR?
- Yes. The skill applies both EU GDPR (supervised by the EDPB and national DPAs) and UK GDPR (supervised by the ICO). It flags divergences between the two regimes where they affect the DPIA output.
- My processing descriptions contain sensitive internal details. Are they safe?
- Your processing activity descriptions stay with your agent. The agent works locally with your descriptions and queries Legalcode only for the regulatory framework — GDPR articles, EDPB guidance, DPA positions. Searches are processed, never stored.
- Can the output be used as the final DPIA for regulatory purposes?
- The output is designed to be a substantive starting point for DPO review, not a final signed-off document. Your DPO should review, validate, and sign the DPIA before it is relied upon.
- What if the processing activity involves AI systems?
- The skill includes an AI-specific risk module that addresses algorithmic decision-making, profiling, and the intersection of GDPR Article 22 with the EU AI Act's high-risk AI system requirements.
Run DPIA Generator locally — use your own agent
Plug Legalcode into your AI agent and work with your own documents locally. Free account access includes all five tools, every supported non-patent source, and full source retrieval through MCP Fetch. Pro keeps the same MCP surface and adds patent Search/Fetch, organization-key REST access, signed REST downloads, and 25,000 weighted units per month at $25/month billed annually at $300 for 12 months, or $39.99/month billed monthly. The full skill library is available on annual plans.