Hermetics RGPD

Working · 2.1 s

fr.hermetics/rgpdv0.4.0 Domain verified

EU data protection law for AI agents: GDPR, AI Act, EDPB, CJEU and national law, with status.

Legal & Government

Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://hermetics.fr/api/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

gdpr_obligations Read-only

Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.

countrystring, required

Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT).

aiboolean

True if it develops or uses AI systems that interact with or make decisions about people.

cctvboolean

True if it uses video surveillance (CCTV).

websiteboolean

True if the company has a website or app.

employeesinteger

Number of employees (0 if none).

processorsboolean

True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted.

large_scaleboolean

True if the processing concerns a large number of people (large scale).

public_sectorboolean

True if the organisation is a public authority or public body.

email_marketingboolean

True if the company sends marketing e-mails or SMS to individuals.

vulnerable_peopleboolean

True if it processes data of vulnerable people (children, patients, elderly people).

automated_decisionsboolean

True if it takes automated decisions with legal or similarly significant effects on people.

evaluation_or_scoringboolean

True if it evaluates or scores people (credit scoring, profiling, performance rating).

non_essential_cookiesboolean

True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels).

special_category_databoolean

True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions).

systematic_monitoringboolean

True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas).

transfers_outside_eeaboolean

True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS).

Try it

Call this server's tools from your browser. Nothing to install.

https://hermetics.fr/api/mcp

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

gdpr_obligations Read-only

countrystring, required

Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT).

aiboolean

True if it develops or uses AI systems that interact with or make decisions about people.

cctvboolean

True if it uses video surveillance (CCTV).

websiteboolean

True if the company has a website or app.

employeesinteger

Number of employees (0 if none).

processorsboolean

True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted.

large_scaleboolean

True if the processing concerns a large number of people (large scale).

public_sectorboolean

True if the organisation is a public authority or public body.

email_marketingboolean

True if the company sends marketing e-mails or SMS to individuals.

vulnerable_peopleboolean

True if it processes data of vulnerable people (children, patients, elderly people).

automated_decisionsboolean

True if it takes automated decisions with legal or similarly significant effects on people.

evaluation_or_scoringboolean

True if it evaluates or scores people (credit scoring, profiling, performance rating).

non_essential_cookiesboolean

True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels).

special_category_databoolean

True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions).

systematic_monitoringboolean

True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas).

transfers_outside_eeaboolean

True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS).

Tools (8)

gdpr_obligations

read-only

Argument	Type	Description
ai	boolean	True if it develops or uses AI systems that interact with or make decisions about people.
cctv	boolean	True if it uses video surveillance (CCTV).
country*	string	Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT).
website	boolean	True if the company has a website or app.
employees	integer	Number of employees (0 if none).
processors	boolean	True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted.
large_scale	boolean	True if the processing concerns a large number of people (large scale).
public_sector	boolean	True if the organisation is a public authority or public body.
email_marketing	boolean	True if the company sends marketing e-mails or SMS to individuals.
vulnerable_people	boolean	True if it processes data of vulnerable people (children, patients, elderly people).
automated_decisions	boolean	True if it takes automated decisions with legal or similarly significant effects on people.
evaluation_or_scoring	boolean	True if it evaluates or scores people (credit scoring, profiling, performance rating).
non_essential_cookies	boolean	True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels).
special_category_data	boolean	True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions).
systematic_monitoring	boolean	True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas).
transfers_outside_eea	boolean	True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "country"
  ],
  "properties": {
    "ai": {
      "type": "boolean",
      "description": "True if it develops or uses AI systems that interact with or make decisions about people."
    },
    "cctv": {
      "type": "boolean",
      "description": "True if it uses video surveillance (CCTV)."
    },
    "country": {
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "type": "string",
      "description": "Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT)."
    },
    "website": {
      "type": "boolean",
      "description": "True if the company has a website or app."
    },
    "employees": {
      "type": "integer",
      "maximum": 1000000,
      "minimum": 0,
      "description": "Number of employees (0 if none)."
    },
    "processors": {
      "type": "boolean",
      "description": "True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted."
    },
    "large_scale": {
      "type": "boolean",
      "description": "True if the processing concerns a large number of people (large scale)."
    },
    "public_sector": {
      "type": "boolean",
      "description": "True if the organisation is a public authority or public body."
    },
    "email_marketing": {
      "type": "boolean",
      "description": "True if the company sends marketing e-mails or SMS to individuals."
    },
    "vulnerable_people": {
      "type": "boolean",
      "description": "True if it processes data of vulnerable people (children, patients, elderly people)."
    },
    "automated_decisions": {
      "type": "boolean",
      "description": "True if it takes automated decisions with legal or similarly significant effects on people."
    },
    "evaluation_or_scoring": {
      "type": "boolean",
      "description": "True if it evaluates or scores people (credit scoring, profiling, performance rating)."
    },
    "non_essential_cookies": {
      "type": "boolean",
      "description": "True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels)."
    },
    "special_category_data": {
      "type": "boolean",
      "description": "True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions)."
    },
    "systematic_monitoring": {
      "type": "boolean",
      "description": "True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas)."
    },
    "transfers_outside_eea": {
      "type": "boolean",
      "description": "True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS)."
    }
  },
  "additionalProperties": false
}

list_processing_records

Lists the records of processing activities (GDPR art. 30(1)) saved in the Hermetics account linked to the connection, in their latest version, with their full content. For an account of a Hermetics client organization, lists the organization's whole register on the Hermetics platform, whatever the origin of each record, with its status. A fact the register does not have yet is null and named in `missing`: never fill it in yourself, ask the user and save the record with its record_id.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

pending_reviews

Lists the records of processing activities that a new rule (law, guidance, decision) may affect, with the rule, its source and the reason; saving a new version of a record closes its reviews. Reviews are part of the paid plans.

read-only

No arguments.

Input schema (JSON)

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

prepare_analysis

Prepares, in the Hermetics space of the organization, the analysis of a record of the register with the same engines as the Hermetics platform: legal basis, DPIA, legitimate interests assessment, transfer impact assessment, information notice (art. 13 and 14), the privacy policy of the whole register, or the art. 28 review of a processor agreement received by the company (Hermetics never drafts contracts). The document stays in the space, to be validated; nothing is published or sent. Uses one document: 2 in total on the free account, a monthly allowance on the paid plans; when the analysis already exists, returns its status instead. Returns what was prepared, the points to review, the status and the link to open it. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Argument	Type	Description
type*	string	legal_basis (art. 6), dpia (art. 35), lia (legitimate interests assessment), tia (transfer impact assessment, art. 44 to 49), information_notice (art. 13 and 14), privacy_policy (the whole register), processor_agreement_review (art. 28 review of a processor agreement received by the company).
notes	string	Facts or context from the user for the preparation; no personal data needed.
record_id	string	Code of the record in the register (e.g. AT-001); required for every type except privacy_policy.
agreement_text	string	Full text of the processor agreement received by the company (processor_agreement_review only).
processor_name	string

record_request

Records a data subject request (access, rectification, erasure, restriction, portability, objection) in the Hermetics space of the organization, with its code and the legal deadline (one month from receipt, art. 12(3), extendable). Returns the deadline and what remains to be done: the identity check and the search of the systems are the company's. Nothing is sent to the requester. The free account tracks 10 requests a year; the paid plans have no limit. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Argument	Type	Description
notes	string	Other context for the handling of the request.
right*	string	The right exercised (GDPR art. 15 to 21).
channel	string	How the request arrived (e-mail, letter, phone, in person...).
received_on*	string	Date the company received the request (YYYY-MM-DD): the one-month period runs from it.
requester_description*	string	Who made the request and what was asked (e.g. "a former customer asking for a copy of their order history"); no sensitive data beyond what the request needs.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "right",
    "received_on",
    "requester_description"
  ],
  "properties": {
    "notes": {
      "type": "string",
      "maxLength": 2000,
      "description": "Other context for the handling of the request."
    },
    "right": {
      "enum": [
        "access",
        "rectification",
        "erasure",
        "restriction",
        "portability",
        "objection"
      ],
      "type": "string",
      "description": "The right exercised (GDPR art. 15 to 21)."
    },
    "channel": {
      "type": "string",
      "maxLength": 100,
      "description": "How the request arrived (e-mail, letter, phone, in person...)."
    },
    "received_on": {
      "type": "string",
      "description": "Date the company received the request (YYYY-MM-DD): the one-month period runs from it."
    },
    "requester_description": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 10,
      "description": "Who made the request and what was asked (e.g. \"a former customer asking for a copy of their order history\"); no sensitive data beyond what the request needs."
    }
  },
  "additionalProperties": false
}

report_breach

Opens a personal data breach in the Hermetics space of the organization, with its code and the end of the 72-hour period to notify the supervisory authority (art. 33(1)), counted from when the company became aware of it. Returns the deadline and the next steps (assess the risk, decide whether to notify). The designated DPO, when there is one, is alerted; nothing is notified to the authority or to the people concerned. The free account tracks 10 breaches a year; the paid plans have no limit. Prepared from the facts given; the decision is the user's, or the designated DPO validates it when the organization has one.

Argument	Type	Description
ongoing	boolean	True if the breach is still ongoing.
description*	string	What happened, the systems involved and the measures already taken; no personal data needed.
discovered_at*	string	When the company became aware of the breach (ISO 8601 date and time with time zone): the 72-hour period runs from it.
data_categories	array	Categories of personal data concerned, e.g. "identity", "bank details".
people_count_estimate	integer	Approximate number of people concerned.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "discovered_at",
    "description"
  ],
  "properties": {
    "ongoing": {
      "type": "boolean",
      "description": "True if the breach is still ongoing."
    },
    "description": {
      "type": "string",
      "maxLength": 4000,
      "minLength": 20,
      "description": "What happened, the systems involved and the measures already taken; no personal data needed."
    },
    "discovered_at": {
      "type": "string",
      "description": "When the company became aware of the breach (ISO 8601 date and time with time zone): the 72-hour period runs from it."
    },
    "data_categories": {
      "type": "array",
      "items": {
        "type": "string",
        "maxLength": 200,
        "minLength": 1
      },
      "maxItems": 30,
      "description": "Categories of personal data concerned, e.g. \"identity\", \"bank details\"."
    },
    "people_count_estimate": {
      "type": "integer",
      "maximum": 1000000000,
      "minimum": 0,
      "description": "Approximate number of people concerned."
    }
  },
  "additionalProperties": false
}

save_processing_record

Saves one entry of the record of processing activities (GDPR art. 30(1)) in the Hermetics account linked to the connection: new records get a code and every change is kept as a new version, in the account's own register on the Hermetics platform (the free account has no DPO: the user checks the records). When the account belongs to a Hermetics client organization, records go to that organization's register on the Hermetics platform (codes AT-001...), pending its DPO's review; a change to a record the DPO has validated is sent to the DPO as a proposal. Returns the code, the version and the points a DPO would review in the entry; when an existing record is updated, also what changed from the previous version and what the change requires (information notice, proof of consent, processor contract, transfer safeguard, DPIA review). The free account stores 3 records; the paid plans have no record limit.

Argument	Type	Description
name*	string	Short name of the processing activity (e.g. "Payroll", "Newsletter").
purpose*	string	Purpose of the processing (art. 30(1)(b)).
record_id	string	Code of an existing record (e.g. RT-001, or AT-001 in an organization register) to save a new version of it; omit to create a new record.
retention*	string	Retention period or the criteria used to determine it (art. 30(1)(f)).
processors	array	Processors acting on behalf of the company (art. 28).

search_law

Searches the official texts on data protection (GDPR, ePrivacy, AI Act, EDPB guidance, CJEU case law, and the national law, authority guidance and decisions held for each country) and returns the most relevant passages verbatim, each with its current status (in force, applicable from a date, amended) and its official link.

read-only

Argument	Type	Description
country	string	ISO code of an EU or EEA country (e.g. FR, DE, ES) to add its national law and authority guidance to the EU texts; omit for EU texts only.
question*	string	The legal question, in any language (French gives the best results today). Names and personal data are not needed.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "question"
  ],
  "properties": {
    "country": {
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "type": "string",
      "description": "ISO code of an EU or EEA country (e.g. FR, DE, ES) to add its national law and authority guidance to the EU texts; omit for EU texts only."
    },
    "question": {
      "type": "string",
      "maxLength": 2000,
      "minLength": 3,
      "description": "The legal question, in any language (French gives the best results today). Names and personal data are not needed."
    }
  },
  "additionalProperties": false
}

{ "type": "object", "required": [ "name", "purpose", "legal_basis", "data_subjects", "data_categories", "recipients", "retention" ], "properties": { "name": { "type": "string", "maxLength": 150, "minLength": 3, "description": "Short name of the processing activity (e.g. \"Payroll\", \"Newsletter\")." }, "purpose": { "type": "string", "maxLength": 1000, "minLength": 10, "description": "Purpose of the processing (art. 30(1)(b))." }, "record_id": { "type": "string", "description": "Code of an existing record (e.g. RT-001, or AT-001 in an organization register) to save a new version of it; omit to create a new record." }, "retention": { "type": "string", "maxLength": 500, "minLength": 3, "description": "Retention period or the criteria used to determine it (art. 30(1)(f))." }, "processors": { "type": "array", "items": { "type": "string", "maxLength": 200, "minLength": 1 }, "maxItems": 30, "description": "Processors acting on behalf of the company (art. 28)." }, "recipients": { "type": "array", "items": { "type": "string", "maxLength": 200, "minLength": 1 }, "maxItems": 30, "minItems": 1, "description": "Categories of recipients, internal and external (art. 30(1)(d))." }, "legal_basis": { "enum": [ "consent", "contract", "legal_obligation", "vital_interests", "public_task", "legitimate_interests" ], "type": "string", "description": "Legal basis under art. 6(1)." }, "data_subjects": { "type": "array", "items": { "type": "string", "maxLength": 200, "minLength": 1 }, "maxItems": 30, "minItems": 1, "description": "Categories of data subjects (art. 30(1)(c)), e.g. \"employees\", \"customers\"." }, "art9_exception": { "type": "string", "maxLength": 500, "description": "The art. 9(2) exception relied on, if special category data are processed." }, "data_categories": { "type": "array", "items": { "type": "string", "maxLength": 200, "minLength": 1 }, "maxItems": 30, "minItems": 1, "description": "Categories of personal data (art. 30(1)(c)), e.g. \"identity\", \"bank details\"." }, "security_measures": { "type": "array", "items": { "type": "string", "maxLength": 200, "minLength": 1 }, "maxItems": 30, "description": "General description of technical and organisational security measures (art. 30(1)(g))." }, "legal_basis_details": { "type": "string", "maxLength": 1000, "description": "Details of the legal basis: the legal obligation, the contract, or the legitimate interest pursued." }, "special_category_data": { "type": "boolean", "description": "True if special category data (art. 9) are processed." }, "transfers_outside_eea": { "type": "object", "required": [ "countries" ], "properties": { "countries": { "type": "array", "items": { "type": "string", "maxLength": 100, "minLength": 2 }, "maxItems": 30, "minItems": 1 }, "safeguard": { "type": "string", "maxLength": 300, "description": "Adequacy decision, standard contractual clauses, etc. (art. 44 to 49)." } }, "description": "Transfers to third countries (art. 30(1)(e)); omit if none.", "additionalProperties": false } }, "additionalProperties": false }