Deterministic, sourced EU compliance checks: NIS2, DORA, GDPR and the Cyber Resilience Act.
Maintain this server? Claim it
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to get the checklist items by area, critical ones marked. Call with yes, partial or no per item to get a score, a compliance label and the open items.
Item id to answer, e.g. {"c1": "yes", "c3": "partial"}. Unanswered items count as gaps.
Use when someone asks whether their cookie banner or cookie consent is compliant in the EU (ePrivacy Art. 5(3) and GDPR consent rules). Call without answers to get the checklist items by area, critical ones marked. Call with yes, partial or no per item to get a score, a compliance label and the open items.
| Argument | Type | Description |
|---|---|---|
| answers | object | Item id to answer, e.g. {"c1": "yes", "c3": "partial"}. Unanswered items count as gaps. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Item id to answer, e.g. {\"c1\": \"yes\", \"c3\": \"partial\"}. Unanswered items count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use after cookie_consent_check when the user wants to fix their cookie consent. Returns every open item with the fix, its legal source (ePrivacy, GDPR, CJEU Planet49, EDPB) and a 30/60/90-day roadmap. Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Item id to answer, e.g. {"c1": "yes", "c3": "partial"}. Unanswered items count as gaps. |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Item id to answer, e.g. {\"c1\": \"yes\", \"c3\": \"partial\"}. Unanswered items count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use when a manufacturer of hardware or software sold in the EU learns of an actively exploited vulnerability or a security incident in its product. Applies Art. 14 of the Cyber Resilience Act (Regulation (EU) 2024/2847), in force since 11 September 2026: whether a report is due, the 24-hour, 72-hour and final report deadlines, where to report, and informing users.
| Argument | Type | Description |
|---|---|---|
| event* | string | actively_exploited_vulnerability: reliable evidence that a malicious actor exploited it; severe_incident: an incident affecting the product's security |
| malicious_code | boolean | Severe incident test, Art. 14(5)(b): it led or can lead to malicious code in the product or in users' systems |
| is_manufacturer | boolean | Develops or manufactures the product, or has it designed or made, and markets it under its own name or trademark |
| product_with_digital_elements | boolean | Software or hardware product (and its remote data processing) made available in the EU whose intended or foreseeable use includes a data connection to a device or network (Arts. 2(1), 3(1)); some products under sector laws, such as medical devices and vehicles, are excluded (Art. 2(2)-(4)) |
| affects_data_or_functions_protection | boolean | Severe incident test, Art. 14(5)(a): it harms or can harm the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions |
Use after cyber_risk_score when the user wants to reduce their risk. Returns every gap with a recommended action, a priority, NIST CSF 2.0 and NIS2 references and a 30/60/90-day roadmap (MFA, encryption, patching, incident response and backups first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Question id to answer, e.g. {"q1": "yes", "q4": "partial"}. Unanswered questions score zero. |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"q1\": \"yes\", \"q4\": \"partial\"}. Unanswered questions score zero.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use for a quick view of a small organisation's cyber risk ('how secure are we?', 'what is our cyber risk score?'). Call without answers to get 15 weighted questions on access, data, systems, people, incident response and backups. Call with yes, partial or no per question to get a 0-100 score, a risk level and a score per category.
| Argument | Type | Description |
|---|---|---|
| answers | object | Question id to answer, e.g. {"q1": "yes", "q4": "partial"}. Unanswered questions score zero. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"q1\": \"yes\", \"q4\": \"partial\"}. Unanswered questions score zero.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use when someone maps personal data flows or builds GDPR records of processing activities (ROPA, Art. 30). Give the flows (name, purpose, data categories, recipients, legal basis, retention, transfers); returns, per flow, what an Art. 30 record still lacks, plus the allowed values for categories, legal bases and safeguards.
| Argument | Type | Description |
|---|---|---|
| flows* | array |
{
"type": "object",
"required": [
"flows"
],
"properties": {
"flows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Name of the processing activity, e.g. 'Newsletter'"
},
"source": {
"type": "string"
},
"purpose": {
"type": "string"
},
"dpiaDone": {
"enum": [
"yes",
"planned",
"no"
],
"type": "string"
},
"retention": {
"type": "string",
"description": "How long the data is kept, or the criteria"
},
"legalBasis": {
"enum": [
"Consent (Art. 6(1)(a))",
"Contract (Art. 6(1)(b))",
"Legal Obligation (Art. 6(1)(c))",
"Vital Interests (Art. 6(1)(d))",
"Public Interest (Art. 6(1)(e))",
"Legitimate Interest (Art. 6(1)(f))",
"Not determined"
],
"type": "string"
},
"processing": {
"type": "string"
},
"destination": {
"type": "string",
"description": "Recipients or systems the data goes to"
},
"dataCategories": {
"type": "array",
"items": {
"enum": [
"Names & Contact",
"Identity Documents",
"Financial Data",
"Health Data",
"Employee Data",
"Customer Data",
"Children's Data",
"Location Data",
"Biometric Data",
"Online Identifiers",
"Special Category",
"Other"
],
"type": "string"
}
},
"transferCountry": {
"type": "string",
"description": "Country outside the EEA the data goes to, or N/A"
},
"transferSafeguard": {
"enum": [
"N/A (no transfer)",
"Adequacy decision (incl. EU-US Data Privacy Framework)",
"Standard Contractual Clauses (SCCs)",
"Binding Corporate Rules (BCRs)",
"Other Art. 46 safeguard",
"Art. 49 derogation (e.g. explicit consent)",
"Not in place"
],
"type": "string"
}
},
"additionalProperties": false
},
"maxItems": 100
}
},
"additionalProperties": false
}Use after data_flow_record_check for a compliance review of each personal data flow: legal basis, special category and children's data, consent and legitimate interest records, retention, international transfer tools and transfer impact assessments, and DPIA need, with an action, GDPR article and 30/60/90-day roadmap. Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| flows* | array |
{
"type": "object",
"required": [
"flows"
],
"properties": {
"flows": {
"type": "array",
"items": {
"type": "object",
"properties": {
"name": {
"type": "string",
"description": "Name of the processing activity, e.g. 'Newsletter'"
},
"source": {
"type": "string"
},
"purpose": {
"type": "string"
},
"dpiaDone": {
"enum": [
"yes",
"planned",
"no"
],
"type": "string"
},
"retention": {
"type": "string",
"description": "How long the data is kept, or the criteria"
},
"legalBasis": {
"enum": [
"Consent (Art. 6(1)(a))",
"Contract (Art. 6(1)(b))",
"Legal Obligation (Art. 6(1)(c))",
"Vital Interests (Art. 6(1)(d))",
"Public Interest (Art. 6(1)(e))",
"Legitimate Interest (Art. 6(1)(f))",
"Not determined"
],
"type": "string"
},
"processing": {
"type": "string"
},
"destination": {
"type": "string",
"description": "Recipients or systems the data goes to"
},
"dataCategories": {
"type": "array",
"items": {
"enum": [
"Names & Contact",
"Identity Documents",
"Financial Data",
"Health Data",
"Employee Data",
"Customer Data",
"Children's Data",
"Location Data",
"Biometric Data",
"Online Identifiers",
"Special Category",
"Other"
],
"type": "string"
}
},
"transferCountry": {
"type": "string",
"description": "Country outside the EEA the data goes to, or N/A"
},
"transferSafeguard": {
"enum": [
"N/A (no transfer)",
"Adequacy decision (incl. EU-US Data Privacy Framework)",
"Standard Contractual Clauses (SCCs)",
"Binding Corporate Rules (BCRs)",
"Other Art. 46 safeguard",
"Art. 49 derogation (e.g. explicit consent)",
"Not in place"
],
"type": "string"
}
},
"additionalProperties": false
},
"maxItems": 100
}
},
"additionalProperties": false
}Use for 'what does DORA require?', DORA compliance checklists or gap reviews. Returns the core DORA (Regulation (EU) 2022/2554) requirements for financial entities, grouped by section with the article for each, leaving out those that DORA itself disapplies for microenterprises or for entities under the simplified ICT risk management framework of Art. 16.
| Argument | Type | Description |
|---|---|---|
| microenterprise | boolean | The financial entity is a microenterprise (DORA Art. 3(60)) |
| simplified_framework | boolean | The entity is listed in DORA Art. 16(1) and uses the simplified framework |
{
"type": "object",
"properties": {
"microenterprise": {
"type": "boolean",
"description": "The financial entity is a microenterprise (DORA Art. 3(60))"
},
"simplified_framework": {
"type": "boolean",
"description": "The entity is listed in DORA Art. 16(1) and uses the simplified framework"
}
},
"additionalProperties": false
}Use when a bank, insurer, investment firm, payment or crypto-asset firm or other financial entity has an IT outage, cyber attack or data incident and asks whether it must be reported under DORA. Classifies the ICT-related incident as major or not under DORA, applying the criteria and materiality thresholds of Commission Delegated Regulation (EU) 2024/1772 (Arts. 6, 8 and 9). Returns the decision, which criteria are met, and the reporting time limits if major. Leave out what you do not know.
| Argument | Type | Description |
|---|---|---|
| duration_hours | number | |
| data_impact_adverse | boolean | Impact on availability, authenticity, integrity or confidentiality of data that harms business objectives or regulatory compliance (Art. 9(5)(a)) |
| reputational_impact | boolean | Media coverage, repetitive complaints, likely failure to meet regulatory requirements, or likely loss of clients with material impact (Art. 2) |
| costs_and_losses_eur | number | Direct and indirect costs and losses per Art. 7, without financial recoveries |
| affected_clients_count | integer | |
| affected_clients_percent | number | Affected clients as % of all clients using the affected service |
Use to assess how ready a financial entity is for DORA, or to find its gaps. Call without answers to get the 39 questions in five pillars (ICT risk management, incident management, resilience testing, ICT third-party risk, information sharing), each with its DORA article. Call with answers (yes, partial, no per question id) to get a score per pillar, an overall readiness level and the gaps.
| Argument | Type | Description |
|---|---|---|
| answers | object | Question id to answer, e.g. {"p1_1": "yes", "p2_3": "partial"}. Unanswered questions count as gaps. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"p1_1\": \"yes\", \"p2_3\": \"partial\"}. Unanswered questions count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use after dora_gap_assessment when the user wants a plan to close their DORA gaps. Turns the same answers into every gap with a recommended action, a priority, the DORA article and a 30/60/90-day roadmap (ICT risk management and incident management first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Question id to answer, e.g. {"p1_1": "yes", "p2_3": "partial"}. Unanswered questions count as gaps. |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"p1_1\": \"yes\", \"p2_3\": \"partial\"}. Unanswered questions count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use when a personal data breach has happened (data lost, stolen, sent to the wrong person, encrypted by ransomware, accessed without authorisation) to decide whether the GDPR requires notifying the supervisory authority within 72 hours (Art. 33) and the people affected (Art. 34), applying the exceptions. Needs the risk level of the breach: unlikely, risk or high.
| Argument | Type | Description |
|---|---|---|
| risk* | string | Likely risk to people's rights and freedoms (EDPB Guidelines 9/2022): consider the type of breach, the sensitivity and volume of the data, how easily people can be identified, how severe the consequences are, and vulnerable people such as children |
| role | string | Controller decides why and how data are processed; a processor acts on its behalf |
| hours_since_aware | number | Hours since the controller had a reasonable degree of certainty that a breach occurred |
| data_unintelligible | boolean | The affected data were unintelligible to unauthorised people, e.g. state-of-the-art encryption with the key not compromised |
| individual_contact_disproportionate | boolean | Contacting each person would involve disproportionate effort, e.g. no contact details |
| subsequent_measures_remove_high_risk |
Use to check how far an organisation is with GDPR compliance, or to list what GDPR requires in practice. Call without input to get the 48 checklist items in 8 areas (lawfulness, transparency and rights, minimisation and retention, security, breaches, processors, accountability, international transfers), each with its article. Call with the ids done (and optional items not applicable) to get the completion score and the open items.
| Argument | Type | Description |
|---|---|---|
| done | array | Ids of the items already in place |
| not_applicable | array | Ids of optional items that do not apply (only items marked optional) |
{
"type": "object",
"properties": {
"done": {
"type": "array",
"items": {
"type": "string"
},
"description": "Ids of the items already in place"
},
"not_applicable": {
"type": "array",
"items": {
"type": "string"
},
"description": "Ids of optional items that do not apply (only items marked optional)"
}
},
"additionalProperties": false
}Use after gdpr_dpia_screening when the user needs the DPIA worked out: a risk register linking each high or medium risk to its measures with coverage and indicative residual risk, and every gap (legal basis, special category data, necessity, missing measures, transfers, prior consultation under Art. 36) with an action, priority, article and a 30/60/90-day roadmap. Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| c1 | string | Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)? |
| c2 | string | Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)? |
| c3 | string | Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)? |
| c4 | string | Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)? |
| c5 | string | Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)? |
| c6 | string | Does it combine or match datasets from different sources in ways people would not expect? |
Use when someone plans new processing of personal data (a new system, AI use, monitoring, profiling) and asks whether a data protection impact assessment is required or how risky it is. Applies GDPR Art. 35(3), national lists and the nine WP248 rev.01 criteria, scores necessity and mitigation, and gives an indicative residual risk. Call without input to get the questions; every input is optional.
| Argument | Type | Description |
|---|---|---|
| c1 | string | Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)? |
| c2 | string | Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)? |
| c3 | string | Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)? |
| c4 | string | Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)? |
| c5 | string | Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)? |
| c6 | string | Does it combine or match datasets from different sources in ways people would not expect? |
Use for 'how big could a GDPR fine be?' or 'how are GDPR fines calculated?'. Applies step 2 of the EDPB Guidelines 04/2022 method: the Art. 83(4) or 83(5) legal maximum, the starting amount band for the seriousness of the infringement, and the turnover adjustment. Give the seriousness, or the facts to let ClevSec suggest it. Returns a starting range in EUR, not a prediction of a real fine.
| Argument | Type | Description |
|---|---|---|
| fault | string | low: measures in place but one failed; clear: a known risk not addressed; intent: intentional or against advice |
| damage | string | |
| duration | string | short: under a month; medium: 1 to 12 months; long: over a year |
| seriousness | string | Seriousness per EDPB Guidelines 04/2022 para. 60; omit to have it suggested from the facts below |
| data_categories | array | basic contact data, financial, other personal (e.g. location), special categories (Art. 9), children's data, criminal data (Art. 10) |
| people_affected | integer | |
| infringement_tier* | string | 83(4): controller/processor obligations such as security (Art. 32) and breach notification (Arts. 33-34). 83(5): principles, legal basis, data subject rights, transfers |
Use after gdpr_checklist_assessment when the user wants a plan to close their GDPR gaps. Turns the same input into every open item with a recommended action, a priority, the GDPR article and a 30/60/90-day roadmap (lawfulness, records, breach handling and processor contracts first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| done | array | Ids of the items already in place |
| not_applicable | array | Ids of optional items that do not apply (only items marked optional) |
{
"type": "object",
"properties": {
"done": {
"type": "array",
"items": {
"type": "string"
},
"description": "Ids of the items already in place"
},
"not_applicable": {
"type": "array",
"items": {
"type": "string"
},
"description": "Ids of optional items that do not apply (only items marked optional)"
}
},
"additionalProperties": false
}Use to check how close an organisation is to ISO/IEC 27001:2022 certification, or to list the Annex A controls in practice. Call without answers to get 41 control checks in four themes (organizational, people, physical, technological) with their Annex A references. Call with a status per control (implemented, partial, planned, not_impl) to get a score per theme, a readiness level and the gaps.
| Argument | Type | Description |
|---|---|---|
| answers | object | Control question id to status, e.g. {"o1": "implemented", "t3": "planned"}. Unanswered controls count as gaps. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Control question id to status, e.g. {\"o1\": \"implemented\", \"t3\": \"planned\"}. Unanswered controls count as gaps.",
"additionalProperties": {
"enum": [
"implemented",
"partial",
"planned",
"not_impl"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use after iso27001_gap_assessment when the user wants a plan towards ISO/IEC 27001 certification. Turns the same statuses into every gap with a recommended action, a priority, the Annex A control and a 30/60/90-day roadmap (organizational controls first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Control question id to status, e.g. {"o1": "implemented", "t3": "planned"}. Unanswered controls count as gaps. |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Control question id to status, e.g. {\"o1\": \"implemented\", \"t3\": \"planned\"}. Unanswered controls count as gaps.",
"additionalProperties": {
"enum": [
"implemented",
"partial",
"planned",
"not_impl"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use to measure an organisation's cybersecurity maturity or to benchmark it against NIST CSF 2.0. Call without answers to get 39 capabilities in the six CSF functions and the 1-5 levels. Call with a level per capability to get the average per function and an overall maturity level.
| Argument | Type | Description |
|---|---|---|
| answers | object | Question id to maturity level 1-5, e.g. {"gv1": 2, "id1": 3}. Unanswered questions count as level 1. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Question id to maturity level 1-5, e.g. {\"gv1\": 2, \"id1\": 3}. Unanswered questions count as level 1.",
"additionalProperties": {
"type": "integer",
"maximum": 5,
"minimum": 1
}
}
},
"additionalProperties": false
}Use after maturity_assessment when the user wants to raise their maturity. Lists every capability below the target level (3 or 4) with the next action, NIST CSF 2.0 subcategory, NIS2 article and a 30/60/90-day roadmap (govern and identify first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Question id to maturity level 1-5, e.g. {"gv1": 2, "id1": 3}. Unanswered questions count as level 1. |
| target_level | integer |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Question id to maturity level 1-5, e.g. {\"gv1\": 2, \"id1\": 3}. Unanswered questions count as level 1.",
"additionalProperties": {
"type": "integer",
"maximum": 5,
"minimum": 1
}
},
"target_level": {
"enum": [
3,
4
],
"type": "integer"
}
},
"additionalProperties": false
}Use to assess how ready an organisation is for NIS2 cybersecurity requirements, or to find its gaps. Call without answers to get the 53 questions in nine domains (governance, risk, incidents, continuity, supply chain, network security, vulnerabilities, training, cryptography), each mapped to NIS2 Arts. 20, 21 or 23. Call with answers (yes, partial, no per question id) to get a score per domain, an overall readiness level and the gaps.
| Argument | Type | Description |
|---|---|---|
| answers | object | Question id to answer, e.g. {"g1": "yes", "r2": "partial"}. Omit to get the questions. Unanswered questions count as gaps. |
{
"type": "object",
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"g1\": \"yes\", \"r2\": \"partial\"}. Omit to get the questions. Unanswered questions count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use after nis2_gap_assessment when the user wants a plan to close their NIS2 gaps. Turns the same answers into every gap with a recommended action, a priority, the NIS2 article and a 30/60/90-day roadmap (governance, risk and incident gaps first). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| answers* | object | Question id to answer, e.g. {"g1": "yes", "r2": "partial"}. Omit to get the questions. Unanswered questions count as gaps. |
{
"type": "object",
"required": [
"answers"
],
"properties": {
"answers": {
"type": "object",
"description": "Question id to answer, e.g. {\"g1\": \"yes\", \"r2\": \"partial\"}. Omit to get the questions. Unanswered questions count as gaps.",
"additionalProperties": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string"
}
}
},
"additionalProperties": false
}Use for questions like 'does NIS2 apply to my company?', 'are we an essential or important entity?' or 'is a company of this size and sector in scope?'. Indicates whether the NIS2 Directive applies to an organisation and in which category (essential or important), from its sector, size and type, applying Arts. 2 and 3 of Directive (EU) 2022/2555 and the size rule of Recommendation 2003/361/EC. An indication only: national law and the member state's list decide.
| Argument | Type | Description |
|---|---|---|
| sector | string | The Annex I or II sector of the entity's activity; omit if none applies |
| provider_type | string | Special provider types covered regardless of size (Art. 2(2)(a), 2(4)) |
| staff_headcount* | number | Staff in annual work units, including partner and linked enterprises |
| annual_turnover_eur | number | |
| public_administration | string | |
| balance_sheet_total_eur | number | |
| critical_entity_under_cer | boolean | Identified as a critical entity under Directive (EU) 2022/2557 |
Use when writing or checking a privacy policy or privacy notice. Lists every item the GDPR requires with its article, for data collected from the person (Art. 13) or obtained from other sources (Art. 14), when the notice must be given, and the exceptions. Tell it which situations apply to drop items you do not need.
| Argument | Type | Description |
|---|---|---|
| source | string | data_subject: collected from the person (forms, accounts, cookies); other_source: from third parties, public sources or data brokers |
| has_dpo | boolean | A data protection officer is appointed |
| relies_on_consent | boolean | |
| automated_decisions | boolean | Solely automated decisions with legal or similarly significant effects, including profiling (Art. 22) |
| transfers_outside_eea | boolean | |
| relies_on_legitimate_interests | boolean |
{
"type": "object",
"properties": {
"source": {
"enum": [
"data_subject",
"other_source"
],
"type": "string",
"description": "data_subject: collected from the person (forms, accounts, cookies); other_source: from third parties, public sources or data brokers"
},
"has_dpo": {
"type": "boolean",
"description": "A data protection officer is appointed"
},
"relies_on_consent": {
"type": "boolean"
},
"automated_decisions": {
"type": "boolean",
"description": "Solely automated decisions with legal or similarly significant effects, including profiling (Art. 22)"
},
"transfers_outside_eea": {
"type": "boolean"
},
"relies_on_legitimate_interests": {
"type": "boolean"
}
},
"additionalProperties": false
}Use for any question about incident or breach reporting deadlines in the EU (for example 'how long do we have to report a breach / a cyber incident?'). Lists who must report what, to whom and by when under GDPR (personal data breaches), NIS2 (significant incidents), DORA (major ICT-related incidents at financial entities) and the Cyber Resilience Act (actively exploited vulnerabilities and severe incidents), with the article for each deadline and when the clock starts.
| Argument | Type | Description |
|---|---|---|
| regimes | array | Limit to these regimes; omit for all |
{
"type": "object",
"properties": {
"regimes": {
"type": "array",
"items": {
"enum": [
"GDPR",
"NIS2",
"DORA",
"CRA"
],
"type": "string"
},
"description": "Limit to these regimes; omit for all"
}
},
"additionalProperties": false
}Use after vendor_risk_assessment when the user needs to act on a vendor's gaps. Returns every gap with an action, the evidence to request from the vendor, ISO 27001 / GDPR / NIS2 / DORA references and a roadmap (before signing first), plus the contract clauses to include (GDPR Art. 28, NIS2 Art. 21, DORA Art. 30 when they apply). Requires ClevSec Pro.
| Argument | Type | Description |
|---|---|---|
| bcp1 | string | Does the vendor have a business continuity / disaster recovery plan? |
| bcp2 | string | Does the vendor offer a defined SLA with uptime guarantees? |
| bcp3 | string | Can data be exported/migrated if you terminate the relationship? |
| bcp4 | string | Does the vendor have geographic redundancy for critical services? |
| bcp5 | string | Is the vendor financially stable (no signs of distress)? |
| com1 | string | Is the vendor compliant with GDPR (if processing EU personal data)? |
| com2 | string | Will the vendor sign a Data Processing Agreement? |
| com3 | string | Does the vendor provide right-to-audit or access to audit reports? |
Use when an organisation evaluates a supplier, SaaS or ICT provider (vendor due diligence, third-party risk, supply chain security under NIS2 Art. 21(2)(d) or DORA). Call without input to get the questions. Call with the vendor profile (type, criticality, data access, regimes) and answers (yes, partial, no, unknown) to get a risk score, risk level, monitoring tier and the gaps.
| Argument | Type | Description |
|---|---|---|
| bcp1 | string | Does the vendor have a business continuity / disaster recovery plan? |
| bcp2 | string | Does the vendor offer a defined SLA with uptime guarantees? |
| bcp3 | string | Can data be exported/migrated if you terminate the relationship? |
| bcp4 | string | Does the vendor have geographic redundancy for critical services? |
| bcp5 | string | Is the vendor financially stable (no signs of distress)? |
| com1 | string | Is the vendor compliant with GDPR (if processing EU personal data)? |
| com2 | string | Will the vendor sign a Data Processing Agreement? |
| com3 | string |
{
"type": "object",
"required": [
"event"
],
"properties": {
"event": {
"enum": [
"actively_exploited_vulnerability",
"severe_incident"
],
"type": "string",
"description": "actively_exploited_vulnerability: reliable evidence that a malicious actor exploited it; severe_incident: an incident affecting the product's security"
},
"malicious_code": {
"type": "boolean",
"description": "Severe incident test, Art. 14(5)(b): it led or can lead to malicious code in the product or in users' systems"
},
"is_manufacturer": {
"type": "boolean",
"description": "Develops or manufactures the product, or has it designed or made, and markets it under its own name or trademark"
},
"product_with_digital_elements": {
"type": "boolean",
"description": "Software or hardware product (and its remote data processing) made available in the EU whose intended or foreseeable use includes a data connection to a device or network (Arts. 2(1), 3(1)); some products under sector laws, such as medical devices and vehicles, are excluded (Art. 2(2)-(4))"
},
"affects_data_or_functions_protection": {
"type": "boolean",
"description": "Severe incident test, Art. 14(5)(a): it harms or can harm the product's ability to protect the availability, authenticity, integrity or confidentiality of sensitive or important data or functions"
}
},
"additionalProperties": false
}| member_states_with_impact |
| integer |
| affected_counterparts_percent | number | Affected financial counterparts as % of those active in the affected service |
| critical_service_downtime_hours | number | Downtime of ICT services supporting critical or important functions |
| affected_transactions_value_percent | number | Affected transaction amount as % of the daily average value for the service |
| affected_transactions_number_percent | number | Affected transactions as % of the daily average number for the service |
| affects_critical_or_important_functions | boolean | ICT services or systems supporting critical or important functions are affected (Art. 6(a)) |
| successful_malicious_unauthorised_access | boolean | A successful, malicious and unauthorised access to network and information systems occurred that may result in data losses (Arts. 6(c), 9(5)(b)) |
| affects_authorised_or_supervised_services | boolean | Financial services requiring authorisation or registration, or supervised, are affected (Art. 6(b)) |
| relevant_clients_or_counterparts_affected | boolean | Clients or counterparts identified as relevant under Art. 1(3) are affected |
{
"type": "object",
"properties": {
"duration_hours": {
"type": "number",
"minimum": 0
},
"data_impact_adverse": {
"type": "boolean",
"description": "Impact on availability, authenticity, integrity or confidentiality of data that harms business objectives or regulatory compliance (Art. 9(5)(a))"
},
"reputational_impact": {
"type": "boolean",
"description": "Media coverage, repetitive complaints, likely failure to meet regulatory requirements, or likely loss of clients with material impact (Art. 2)"
},
"costs_and_losses_eur": {
"type": "number",
"minimum": 0,
"description": "Direct and indirect costs and losses per Art. 7, without financial recoveries"
},
"affected_clients_count": {
"type": "integer",
"minimum": 0
},
"affected_clients_percent": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Affected clients as % of all clients using the affected service"
},
"member_states_with_impact": {
"type": "integer",
"minimum": 0
},
"affected_counterparts_percent": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Affected financial counterparts as % of those active in the affected service"
},
"critical_service_downtime_hours": {
"type": "number",
"minimum": 0,
"description": "Downtime of ICT services supporting critical or important functions"
},
"affected_transactions_value_percent": {
"type": "number",
"minimum": 0,
"description": "Affected transaction amount as % of the daily average value for the service"
},
"affected_transactions_number_percent": {
"type": "number",
"minimum": 0,
"description": "Affected transactions as % of the daily average number for the service"
},
"affects_critical_or_important_functions": {
"type": "boolean",
"description": "ICT services or systems supporting critical or important functions are affected (Art. 6(a))"
},
"successful_malicious_unauthorised_access": {
"type": "boolean",
"description": "A successful, malicious and unauthorised access to network and information systems occurred that may result in data losses (Arts. 6(c), 9(5)(b))"
},
"affects_authorised_or_supervised_services": {
"type": "boolean",
"description": "Financial services requiring authorisation or registration, or supervised, are affected (Art. 6(b))"
},
"relevant_clients_or_counterparts_affected": {
"type": "boolean",
"description": "Clients or counterparts identified as relevant under Art. 1(3) are affected"
}
},
"additionalProperties": false
}| boolean |
| Measures taken since then ensure the high risk is no longer likely to materialise |
{
"type": "object",
"required": [
"risk"
],
"properties": {
"risk": {
"enum": [
"unlikely",
"risk",
"high"
],
"type": "string",
"description": "Likely risk to people's rights and freedoms (EDPB Guidelines 9/2022): consider the type of breach, the sensitivity and volume of the data, how easily people can be identified, how severe the consequences are, and vulnerable people such as children"
},
"role": {
"enum": [
"controller",
"processor"
],
"type": "string",
"description": "Controller decides why and how data are processed; a processor acts on its behalf"
},
"hours_since_aware": {
"type": "number",
"minimum": 0,
"description": "Hours since the controller had a reasonable degree of certainty that a breach occurred"
},
"data_unintelligible": {
"type": "boolean",
"description": "The affected data were unintelligible to unauthorised people, e.g. state-of-the-art encryption with the key not compromised"
},
"individual_contact_disproportionate": {
"type": "boolean",
"description": "Contacting each person would involve disproportionate effort, e.g. no contact details"
},
"subsequent_measures_remove_high_risk": {
"type": "boolean",
"description": "Measures taken since then ensure the high risk is no longer likely to materialise"
}
},
"additionalProperties": false
}| c7 |
| string |
| Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)? |
| c8 | string | Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)? |
| c9 | string | Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)? |
| m1 | string | Encryption of personal data at rest and in transit |
| m2 | string | Pseudonymization or anonymization where possible |
| m3 | string | Access controls limiting who can view/modify the data |
| m4 | string | Regular security testing (vulnerability scans, penetration tests) |
| m5 | string | Staff training on data protection for those handling the data |
| m6 | string | Data minimization — collecting only what is strictly necessary |
| m7 | string | Automated deletion at end of retention period |
| m8 | string | Incident response plan covering this processing activity |
| m9 | string | Regular audits or reviews of the processing activity |
| r1 | string | Risk of unauthorized access to personal data (data breach) |
| r2 | string | Risk of data being used for purposes beyond what was communicated |
| r3 | string | Risk of inaccurate data leading to wrong decisions about individuals |
| r4 | string | Risk of excessive data collection beyond what is needed |
| r5 | string | Risk of insufficient transparency — individuals unaware of processing |
| r6 | string | Risk of discrimination or unfair treatment based on the processing |
| r7 | string | Risk of financial loss or economic disadvantage to individuals |
| r8 | string | Risk of reputational damage or social disadvantage to individuals |
| r9 | string | Risk of physical harm or safety concerns |
| t1 | string | Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them? |
| t2 | string | Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal conviction data on a large scale? |
| t3 | string | Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)? |
| t4 | string | Is this type of processing on your supervisory authority's published list of operations that require a DPIA? |
| x1 | string | Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)? |
| m10 | string | Data Processing Agreements with all third-party processors |
| m11 | string | Privacy by design principles applied in system architecture |
| m12 | string | Mechanism for data subjects to exercise their rights easily |
| r10 | string | Risk of loss of confidentiality (e.g. medical or legal privilege) |
| nec1 | string | Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data? |
| nec2 | string | Is the amount of data collected proportionate to the purpose? |
| nec3 | string | Is the retention period limited to what is necessary? |
| nec4 | string | Are data subjects adequately informed about the processing (transparency)? |
| nec5 | string | Can data subjects exercise their rights (access, rectification, erasure, portability)? |
| nec6 | string | If relying on consent, is it freely given, specific, informed, and withdrawable? |
| nec7 | string | If relying on legitimate interest, has a balancing test been conducted? |
| proj_data | array | Categories of personal data |
| proj_legal | string | Legal basis for processing |
| proj_subjects | array | Categories of data subjects |
{
"type": "object",
"properties": {
"c1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)?"
},
"c2": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)?"
},
"c3": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)?"
},
"c4": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)?"
},
"c5": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)?"
},
"c6": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it combine or match datasets from different sources in ways people would not expect?"
},
"c7": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)?"
},
"c8": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)?"
},
"c9": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)?"
},
"m1": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Encryption of personal data at rest and in transit"
},
"m2": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Pseudonymization or anonymization where possible"
},
"m3": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Access controls limiting who can view/modify the data"
},
"m4": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Regular security testing (vulnerability scans, penetration tests)"
},
"m5": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Staff training on data protection for those handling the data"
},
"m6": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Data minimization — collecting only what is strictly necessary"
},
"m7": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Automated deletion at end of retention period"
},
"m8": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Incident response plan covering this processing activity"
},
"m9": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Regular audits or reviews of the processing activity"
},
"r1": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of unauthorized access to personal data (data breach)"
},
"r2": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of data being used for purposes beyond what was communicated"
},
"r3": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of inaccurate data leading to wrong decisions about individuals"
},
"r4": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of excessive data collection beyond what is needed"
},
"r5": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of insufficient transparency — individuals unaware of processing"
},
"r6": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of discrimination or unfair treatment based on the processing"
},
"r7": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of financial loss or economic disadvantage to individuals"
},
"r8": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of reputational damage or social disadvantage to individuals"
},
"r9": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of physical harm or safety concerns"
},
"t1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them?"
},
"t2": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal conviction data on a large scale?"
},
"t3": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)?"
},
"t4": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Is this type of processing on your supervisory authority's published list of operations that require a DPIA?"
},
"x1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)?"
},
"m10": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Data Processing Agreements with all third-party processors"
},
"m11": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Privacy by design principles applied in system architecture"
},
"m12": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Mechanism for data subjects to exercise their rights easily"
},
"r10": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of loss of confidentiality (e.g. medical or legal privilege)"
},
"nec1": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data?"
},
"nec2": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the amount of data collected proportionate to the purpose?"
},
"nec3": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the retention period limited to what is necessary?"
},
"nec4": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Are data subjects adequately informed about the processing (transparency)?"
},
"nec5": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Can data subjects exercise their rights (access, rectification, erasure, portability)?"
},
"nec6": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "If relying on consent, is it freely given, specific, informed, and withdrawable?"
},
"nec7": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "If relying on legitimate interest, has a balancing test been conducted?"
},
"proj_data": {
"type": "array",
"items": {
"enum": [
"Names & contact details",
"Identity documents",
"Financial data",
"Location data",
"Online identifiers / cookies",
"Purchase / transaction history",
"Health data",
"Biometric data",
"Children's data",
"Employee data",
"Criminal offence data",
"Racial / ethnic origin",
"Political opinions",
"Religious beliefs",
"Trade union membership",
"Sexual orientation",
"Genetic data"
],
"type": "string"
},
"description": "Categories of personal data"
},
"proj_legal": {
"enum": [
"Consent (Art. 6(1)(a))",
"Contract (Art. 6(1)(b))",
"Legal obligation (Art. 6(1)(c))",
"Vital interests (Art. 6(1)(d))",
"Public interest (Art. 6(1)(e))",
"Legitimate interest (Art. 6(1)(f))",
"Not yet determined"
],
"type": "string",
"description": "Legal basis for processing"
},
"proj_subjects": {
"type": "array",
"items": {
"enum": [
"Customers",
"Employees",
"Job applicants",
"Website visitors",
"Patients",
"Students / minors",
"Suppliers / partners",
"Members of the public",
"Other"
],
"type": "string"
},
"description": "Categories of data subjects"
}
},
"additionalProperties": false
}| c7 |
| string |
| Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)? |
| c8 | string | Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)? |
| c9 | string | Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)? |
| m1 | string | Encryption of personal data at rest and in transit |
| m2 | string | Pseudonymization or anonymization where possible |
| m3 | string | Access controls limiting who can view/modify the data |
| m4 | string | Regular security testing (vulnerability scans, penetration tests) |
| m5 | string | Staff training on data protection for those handling the data |
| m6 | string | Data minimization — collecting only what is strictly necessary |
| m7 | string | Automated deletion at end of retention period |
| m8 | string | Incident response plan covering this processing activity |
| m9 | string | Regular audits or reviews of the processing activity |
| r1 | string | Risk of unauthorized access to personal data (data breach) |
| r2 | string | Risk of data being used for purposes beyond what was communicated |
| r3 | string | Risk of inaccurate data leading to wrong decisions about individuals |
| r4 | string | Risk of excessive data collection beyond what is needed |
| r5 | string | Risk of insufficient transparency — individuals unaware of processing |
| r6 | string | Risk of discrimination or unfair treatment based on the processing |
| r7 | string | Risk of financial loss or economic disadvantage to individuals |
| r8 | string | Risk of reputational damage or social disadvantage to individuals |
| r9 | string | Risk of physical harm or safety concerns |
| t1 | string | Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them? |
| t2 | string | Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal conviction data on a large scale? |
| t3 | string | Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)? |
| t4 | string | Is this type of processing on your supervisory authority's published list of operations that require a DPIA? |
| x1 | string | Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)? |
| m10 | string | Data Processing Agreements with all third-party processors |
| m11 | string | Privacy by design principles applied in system architecture |
| m12 | string | Mechanism for data subjects to exercise their rights easily |
| r10 | string | Risk of loss of confidentiality (e.g. medical or legal privilege) |
| nec1 | string | Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data? |
| nec2 | string | Is the amount of data collected proportionate to the purpose? |
| nec3 | string | Is the retention period limited to what is necessary? |
| nec4 | string | Are data subjects adequately informed about the processing (transparency)? |
| nec5 | string | Can data subjects exercise their rights (access, rectification, erasure, portability)? |
| nec6 | string | If relying on consent, is it freely given, specific, informed, and withdrawable? |
| nec7 | string | If relying on legitimate interest, has a balancing test been conducted? |
| proj_data | array | Categories of personal data |
| proj_legal | string | Legal basis for processing |
| proj_subjects | array | Categories of data subjects |
{
"type": "object",
"properties": {
"c1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does the processing evaluate or score people (profiling or predicting their performance, finances, health, preferences, reliability, behaviour or location)?"
},
"c2": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve automated decisions with legal or similarly significant effects (for example access to credit, a job or a service)?"
},
"c3": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve systematic monitoring of people (for example online tracking, employee monitoring or CCTV)?"
},
"c4": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it involve sensitive or highly personal data (special category or criminal data, financial data, location data or private communications)?"
},
"c5": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Is the processing large-scale (many people, a large volume or range of data, a long duration or a wide geographic area)?"
},
"c6": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it combine or match datasets from different sources in ways people would not expect?"
},
"c7": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it concern vulnerable people (children, employees, patients, the elderly, or others in an unequal relationship with you)?"
},
"c8": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Does it use innovative technology or a new way of using existing technology (for example AI, biometrics or IoT)?"
},
"c9": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Could the processing itself prevent people from exercising a right or using a service or contract (for example credit screening that decides whether to offer a loan)?"
},
"m1": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Encryption of personal data at rest and in transit"
},
"m2": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Pseudonymization or anonymization where possible"
},
"m3": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Access controls limiting who can view/modify the data"
},
"m4": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Regular security testing (vulnerability scans, penetration tests)"
},
"m5": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Staff training on data protection for those handling the data"
},
"m6": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Data minimization — collecting only what is strictly necessary"
},
"m7": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Automated deletion at end of retention period"
},
"m8": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Incident response plan covering this processing activity"
},
"m9": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Regular audits or reviews of the processing activity"
},
"r1": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of unauthorized access to personal data (data breach)"
},
"r2": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of data being used for purposes beyond what was communicated"
},
"r3": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of inaccurate data leading to wrong decisions about individuals"
},
"r4": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of excessive data collection beyond what is needed"
},
"r5": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of insufficient transparency — individuals unaware of processing"
},
"r6": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of discrimination or unfair treatment based on the processing"
},
"r7": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of financial loss or economic disadvantage to individuals"
},
"r8": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of reputational damage or social disadvantage to individuals"
},
"r9": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of physical harm or safety concerns"
},
"t1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you systematically and extensively evaluate people by automated means (including profiling), and base decisions on it that have legal or similarly significant effects on them?"
},
"t2": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you process special category data (health, biometric, genetic, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation) or criminal conviction data on a large scale?"
},
"t3": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will you systematically monitor a publicly accessible area on a large scale (for example CCTV in shops, stations or streets)?"
},
"t4": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Is this type of processing on your supervisory authority's published list of operations that require a DPIA?"
},
"x1": {
"enum": [
"yes",
"no"
],
"type": "string",
"description": "Will personal data be transferred outside the EU/EEA (including remote access from outside the EEA)?"
},
"m10": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Data Processing Agreements with all third-party processors"
},
"m11": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Privacy by design principles applied in system architecture"
},
"m12": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Mechanism for data subjects to exercise their rights easily"
},
"r10": {
"enum": [
"high",
"medium",
"low"
],
"type": "string",
"description": "Risk of loss of confidentiality (e.g. medical or legal privilege)"
},
"nec1": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the processing necessary to achieve the stated purpose, or could the purpose be achieved with less data?"
},
"nec2": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the amount of data collected proportionate to the purpose?"
},
"nec3": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Is the retention period limited to what is necessary?"
},
"nec4": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Are data subjects adequately informed about the processing (transparency)?"
},
"nec5": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "Can data subjects exercise their rights (access, rectification, erasure, portability)?"
},
"nec6": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "If relying on consent, is it freely given, specific, informed, and withdrawable?"
},
"nec7": {
"enum": [
"yes",
"partial",
"no"
],
"type": "string",
"description": "If relying on legitimate interest, has a balancing test been conducted?"
},
"proj_data": {
"type": "array",
"items": {
"enum": [
"Names & contact details",
"Identity documents",
"Financial data",
"Location data",
"Online identifiers / cookies",
"Purchase / transaction history",
"Health data",
"Biometric data",
"Children's data",
"Employee data",
"Criminal offence data",
"Racial / ethnic origin",
"Political opinions",
"Religious beliefs",
"Trade union membership",
"Sexual orientation",
"Genetic data"
],
"type": "string"
},
"description": "Categories of personal data"
},
"proj_legal": {
"enum": [
"Consent (Art. 6(1)(a))",
"Contract (Art. 6(1)(b))",
"Legal obligation (Art. 6(1)(c))",
"Vital interests (Art. 6(1)(d))",
"Public interest (Art. 6(1)(e))",
"Legitimate interest (Art. 6(1)(f))",
"Not yet determined"
],
"type": "string",
"description": "Legal basis for processing"
},
"proj_subjects": {
"type": "array",
"items": {
"enum": [
"Customers",
"Employees",
"Job applicants",
"Website visitors",
"Patients",
"Students / minors",
"Suppliers / partners",
"Members of the public",
"Other"
],
"type": "string"
},
"description": "Categories of data subjects"
}
},
"additionalProperties": false
}| annual_turnover_eur* | number | Total worldwide annual turnover of the undertaking in the preceding financial year, in EUR |
{
"type": "object",
"required": [
"annual_turnover_eur",
"infringement_tier"
],
"properties": {
"fault": {
"enum": [
"low",
"clear",
"intent"
],
"type": "string",
"description": "low: measures in place but one failed; clear: a known risk not addressed; intent: intentional or against advice"
},
"damage": {
"enum": [
"limited",
"significant",
"severe"
],
"type": "string"
},
"duration": {
"enum": [
"short",
"medium",
"long"
],
"type": "string",
"description": "short: under a month; medium: 1 to 12 months; long: over a year"
},
"seriousness": {
"enum": [
"low",
"medium",
"high"
],
"type": "string",
"description": "Seriousness per EDPB Guidelines 04/2022 para. 60; omit to have it suggested from the facts below"
},
"data_categories": {
"type": "array",
"items": {
"enum": [
"basic",
"financial",
"personal",
"special",
"children",
"criminal"
],
"type": "string"
},
"description": "basic contact data, financial, other personal (e.g. location), special categories (Art. 9), children's data, criminal data (Art. 10)"
},
"people_affected": {
"type": "integer",
"minimum": 0
},
"infringement_tier": {
"enum": [
"83(4)",
"83(5)"
],
"type": "string",
"description": "83(4): controller/processor obligations such as security (Art. 32) and breach notification (Arts. 33-34). 83(5): principles, legal basis, data subject rights, transfers"
},
"annual_turnover_eur": {
"type": "number",
"minimum": 0,
"description": "Total worldwide annual turnover of the undertaking in the preceding financial year, in EUR"
}
},
"additionalProperties": false
}| designated_by_member_state | boolean | Identified by the member state under Art. 2(2)(b)-(e) |
| national_security_or_law_enforcement | boolean | Public administration working in national security, public security, defence or law enforcement (Art. 2(7)) |
{
"type": "object",
"required": [
"staff_headcount"
],
"properties": {
"sector": {
"enum": [
"Energy",
"Transport",
"Banking",
"Financial market infrastructures",
"Health",
"Drinking water",
"Waste water",
"Digital infrastructure",
"ICT service management (business-to-business)",
"Public administration",
"Space",
"Postal and courier services",
"Waste management",
"Manufacture, production and distribution of chemicals",
"Production, processing and distribution of food",
"Manufacturing",
"Digital providers",
"Research"
],
"type": "string",
"description": "The Annex I or II sector of the entity's activity; omit if none applies"
},
"provider_type": {
"enum": [
"none",
"public_electronic_communications",
"qualified_trust_service",
"non_qualified_trust_service",
"tld_registry",
"dns_service",
"domain_name_registration"
],
"type": "string",
"description": "Special provider types covered regardless of size (Art. 2(2)(a), 2(4))"
},
"staff_headcount": {
"type": "number",
"minimum": 0,
"description": "Staff in annual work units, including partner and linked enterprises"
},
"annual_turnover_eur": {
"type": "number",
"minimum": 0
},
"public_administration": {
"enum": [
"none",
"central_government",
"regional",
"local"
],
"type": "string"
},
"balance_sheet_total_eur": {
"type": "number",
"minimum": 0
},
"critical_entity_under_cer": {
"type": "boolean",
"description": "Identified as a critical entity under Directive (EU) 2022/2557"
},
"designated_by_member_state": {
"type": "boolean",
"description": "Identified by the member state under Art. 2(2)(b)-(e)"
},
"national_security_or_law_enforcement": {
"type": "boolean",
"description": "Public administration working in national security, public security, defence or law enforcement (Art. 2(7))"
}
},
"additionalProperties": false
}| com4 | string | Does the vendor's contract include security requirements and SLAs? |
| com5 | string | Does the vendor have adequate insurance coverage (cyber liability)? |
| inc1 | string | Does the vendor have a documented incident response plan? |
| inc2 | string | Will the vendor notify you of security incidents within 24-48 hours? |
| inc3 | string | Has the vendor experienced any data breaches in the last 3 years? |
| inc4 | string | Does the vendor conduct incident response exercises/tabletop tests? |
| sec1 | string | Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? |
| sec2 | string | Does the vendor have a documented information security policy? |
| sec3 | string | Does the vendor encrypt data at rest and in transit? |
| sec4 | string | Does the vendor enforce multi-factor authentication? |
| sec5 | string | Does the vendor conduct regular penetration testing? |
| sec6 | string | Does the vendor have a vulnerability management program? |
| sec7 | string | Does the vendor perform background checks on employees with data access? |
| sup1 | string | Does the vendor disclose its key subprocessors/subcontractors? |
| sup2 | string | Will the vendor notify you before changing subprocessors? |
| sup3 | string | Does the vendor assess the security of its own suppliers? |
| sup4 | string | Are subprocessor contracts held to the same security standards? |
| regimes | array | Which of these apply to your organization? (optional) |
| dataAccess | array | What data will this vendor access? |
| vendorType | string | Type of service |
| criticality | string | How critical is this vendor to your operations? |
{
"type": "object",
"properties": {
"bcp1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a business continuity / disaster recovery plan?"
},
"bcp2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor offer a defined SLA with uptime guarantees?"
},
"bcp3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Can data be exported/migrated if you terminate the relationship?"
},
"bcp4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have geographic redundancy for critical services?"
},
"bcp5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Is the vendor financially stable (no signs of distress)?"
},
"com1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Is the vendor compliant with GDPR (if processing EU personal data)?"
},
"com2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor sign a Data Processing Agreement?"
},
"com3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor provide right-to-audit or access to audit reports?"
},
"com4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor's contract include security requirements and SLAs?"
},
"com5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have adequate insurance coverage (cyber liability)?"
},
"inc1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a documented incident response plan?"
},
"inc2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor notify you of security incidents within 24-48 hours?"
},
"inc3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Has the vendor experienced any data breaches in the last 3 years?"
},
"inc4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor conduct incident response exercises/tabletop tests?"
},
"sec1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)?"
},
"sec2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a documented information security policy?"
},
"sec3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor encrypt data at rest and in transit?"
},
"sec4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor enforce multi-factor authentication?"
},
"sec5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor conduct regular penetration testing?"
},
"sec6": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a vulnerability management program?"
},
"sec7": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor perform background checks on employees with data access?"
},
"sup1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor disclose its key subprocessors/subcontractors?"
},
"sup2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor notify you before changing subprocessors?"
},
"sup3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor assess the security of its own suppliers?"
},
"sup4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Are subprocessor contracts held to the same security standards?"
},
"regimes": {
"type": "array",
"items": {
"enum": [
"nis2",
"dora"
],
"type": "string"
},
"description": "Which of these apply to your organization? (optional)"
},
"dataAccess": {
"type": "array",
"items": {
"enum": [
"none",
"public",
"internal",
"personal",
"financial",
"health"
],
"type": "string"
},
"description": "What data will this vendor access?"
},
"vendorType": {
"enum": [
"SaaS / Cloud Service",
"Infrastructure (IaaS/PaaS)",
"Managed IT Services",
"Consulting / Professional Services",
"Software Vendor",
"Hardware Supplier",
"Outsourced Business Process",
"Other"
],
"type": "string",
"description": "Type of service"
},
"criticality": {
"enum": [
"Critical — essential service, no easy replacement",
"Important — significant impact if disrupted",
"Standard — limited impact, easily replaceable"
],
"type": "string",
"description": "How critical is this vendor to your operations?"
}
},
"additionalProperties": false
}| Does the vendor provide right-to-audit or access to audit reports? |
| com4 | string | Does the vendor's contract include security requirements and SLAs? |
| com5 | string | Does the vendor have adequate insurance coverage (cyber liability)? |
| inc1 | string | Does the vendor have a documented incident response plan? |
| inc2 | string | Will the vendor notify you of security incidents within 24-48 hours? |
| inc3 | string | Has the vendor experienced any data breaches in the last 3 years? |
| inc4 | string | Does the vendor conduct incident response exercises/tabletop tests? |
| sec1 | string | Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)? |
| sec2 | string | Does the vendor have a documented information security policy? |
| sec3 | string | Does the vendor encrypt data at rest and in transit? |
| sec4 | string | Does the vendor enforce multi-factor authentication? |
| sec5 | string | Does the vendor conduct regular penetration testing? |
| sec6 | string | Does the vendor have a vulnerability management program? |
| sec7 | string | Does the vendor perform background checks on employees with data access? |
| sup1 | string | Does the vendor disclose its key subprocessors/subcontractors? |
| sup2 | string | Will the vendor notify you before changing subprocessors? |
| sup3 | string | Does the vendor assess the security of its own suppliers? |
| sup4 | string | Are subprocessor contracts held to the same security standards? |
| regimes | array | Which of these apply to your organization? (optional) |
| dataAccess | array | What data will this vendor access? |
| vendorType | string | Type of service |
| criticality | string | How critical is this vendor to your operations? |
{
"type": "object",
"properties": {
"bcp1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a business continuity / disaster recovery plan?"
},
"bcp2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor offer a defined SLA with uptime guarantees?"
},
"bcp3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Can data be exported/migrated if you terminate the relationship?"
},
"bcp4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have geographic redundancy for critical services?"
},
"bcp5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Is the vendor financially stable (no signs of distress)?"
},
"com1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Is the vendor compliant with GDPR (if processing EU personal data)?"
},
"com2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor sign a Data Processing Agreement?"
},
"com3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor provide right-to-audit or access to audit reports?"
},
"com4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor's contract include security requirements and SLAs?"
},
"com5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have adequate insurance coverage (cyber liability)?"
},
"inc1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a documented incident response plan?"
},
"inc2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor notify you of security incidents within 24-48 hours?"
},
"inc3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Has the vendor experienced any data breaches in the last 3 years?"
},
"inc4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor conduct incident response exercises/tabletop tests?"
},
"sec1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor hold relevant security certifications (ISO 27001, SOC 2, etc.)?"
},
"sec2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a documented information security policy?"
},
"sec3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor encrypt data at rest and in transit?"
},
"sec4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor enforce multi-factor authentication?"
},
"sec5": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor conduct regular penetration testing?"
},
"sec6": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor have a vulnerability management program?"
},
"sec7": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor perform background checks on employees with data access?"
},
"sup1": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor disclose its key subprocessors/subcontractors?"
},
"sup2": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Will the vendor notify you before changing subprocessors?"
},
"sup3": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Does the vendor assess the security of its own suppliers?"
},
"sup4": {
"enum": [
"yes",
"partial",
"no",
"unknown"
],
"type": "string",
"description": "Are subprocessor contracts held to the same security standards?"
},
"regimes": {
"type": "array",
"items": {
"enum": [
"nis2",
"dora"
],
"type": "string"
},
"description": "Which of these apply to your organization? (optional)"
},
"dataAccess": {
"type": "array",
"items": {
"enum": [
"none",
"public",
"internal",
"personal",
"financial",
"health"
],
"type": "string"
},
"description": "What data will this vendor access?"
},
"vendorType": {
"enum": [
"SaaS / Cloud Service",
"Infrastructure (IaaS/PaaS)",
"Managed IT Services",
"Consulting / Professional Services",
"Software Vendor",
"Hardware Supplier",
"Outsourced Business Process",
"Other"
],
"type": "string",
"description": "Type of service"
},
"criticality": {
"enum": [
"Critical — essential service, no easy replacement",
"Important — significant impact if disrupted",
"Standard — limited impact, easily replaceable"
],
"type": "string",
"description": "How critical is this vendor to your operations?"
}
},
"additionalProperties": false
}