GDPR Compliance Verification Agent for Websites and Applications
This agent analyzes your personal data processing and verifies its compliance with the General Data Protection Regulation (GDPR). It identifies compliance gaps, assesses associated risks, and generates a prioritized remediation plan with concrete recommendations.
For who
DPOs, compliance officers, corporate lawyers, GDPR consultants, and SMB executives looking to quickly audit their GDPR compliance.
Input
Description de l'organisation, de ses activités, des traitements de données personnelles réalisés (formulaires, bases clients, RH, marketing, sous-traitants, outils utilisés), des mesures de sécurité en place et des documents de conformité existants (politique de confidentialité, registre des traitements, CGU/CGV, contrats sous-traitants).
steps (4)
Processing Activities Mapping
promptAnalysis and structuring of all declared personal data processing activities
Article-by-Article Compliance Audit
promptSystematic verification of each processing activity's compliance with key GDPR requirements
Risk Assessment and Prioritization
promptClassification of gaps by risk level and remediation urgency
Detailed Remediation Plan
promptGeneration of a concrete corrective action plan with owners and deadlines
Output
Rapport de conformité RGPD complet comprenant : registre des traitements cartographié, grille d'audit article par article avec statuts de conformité, matrice des risques priorisée, et plan de remédiation détaillé avec actions correctives, responsables, échéances et indicateurs de succès.
Example
Input
Our B2B SaaS company (50 employees, 5M EUR revenue) publishes HR management software. We collect data from our clients (companies) and their employees: name, first name, email, social security number, pay slips, sick leave. Hosted on AWS Ireland and AWS US-East. We use Google Analytics, HubSpot for marketing, and Slack internally. No appointed DPO. Privacy policy dating from 2019. Cookie consent via a simple banner 'By continuing, you agree'. No formalized processing register. Payroll subcontractor based in Tunisia without specific contractual clauses.
Output
**Overall compliance score: 35/100 — Critical level** **Register**: 8 processing activities identified, including 3 at very high risk (employee health data, social security numbers, pay slips). **Critical gaps P1**: - No DPO despite being mandatory (large-scale sensitive data processing, Art. 37) - Payroll data transfer to Tunisia without valid transfer mechanism (Art. 44-49) - Health data processing without DPIA (Art. 35) - Cookie banner non-compliant (no equivalent refusal option, consent not freely given) **Important gaps P2**: - Outdated and incomplete privacy policy - No formalized processing register (Art. 30) - Processor contracts without Art. 28 clauses **Phase 1 (urgent)**: Appoint a DPO, suspend Tunisia transfer or implement SCCs, complete the DPIA, redo cookie banner with compliant CMP. **Phase 2**: Update privacy policy, formalize the register, renegotiate processor contracts. **Phase 3**: Train teams, implement rights exercise process, plan semi-annual audits.
Customization
| Parameter | Description | Default |
|---|---|---|
| Secteur d'activité | Secteur de l'organisation pour adapter les exigences sectorielles spécifiques (santé, finance, e-commerce, RH, éducation) | Généraliste |
| Niveau de détail du rapport | Granularité souhaitée pour le rapport : synthétique (direction), standard (DPO), ou exhaustif (audit formel CNIL) | Standard |
| Référentiel complémentaire | Référentiels additionnels à croiser avec le RGPD : recommandations CNIL, ISO 27701, ePrivacy, CCPA, guidelines EDPB | Recommandations CNIL |
Technical Notes
This agent performs an analysis based on declarative information provided by the user. It does not replace a field audit or personalized legal advice. For organizations processing sensitive data at large scale (health, biometrics, judicial data), it is recommended to complement this analysis with a consultation with a certified DPO or specialized firm.
The prompts are calibrated on the GDPR (EU Regulation 2016/679) and EDPB (European Data Protection Board) guidelines. For multi-jurisdictional compliance, activate the appropriate complementary framework (CCPA for the United States, LGPD for Brazil, etc.).
For a more thorough audit, provide your existing documents as input: privacy policy, processing register, processor contracts, completed DPIAs. The agent can then perform a comparative analysis between your documents and regulatory requirements.
Related Prompts
NDA Red-Line Summary
Efficient NDA review and negotiation prep
Write Complete Legal Notices for Your Website
This prompt generates complete legal notices compliant with applicable legislation (e-commerce law, GDPR) for any website type, customized to your legal structure and business.
Matter Summary for Handover
Transitioning matters between attorneys
Analyze Company Bylaws with AI
A prompt to obtain a complete, structured legal analysis of company bylaws covering governance, restrictive clauses, compliance and recommendations.