Hermetics RGPD

Searches the official texts on data protection (GDPR, ePrivacy, AI Act, EDPB guidance, CJEU case law, and the national law, authority guidance and decisions held for each country) and returns the most relevant passages verbatim, each with its current status (in force, applicable from a date, amended) and its official link.

{
  "type": "object",
  "properties": {
    "question": {
      "type": "string",
      "minLength": 3,
      "maxLength": 2000,
      "description": "The legal question, in any language (French gives the best results today). Names and personal data are not needed."
    },
    "country": {
      "type": "string",
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "description": "ISO code of an EU or EEA country (e.g. FR, DE, ES) to add its national law and authority guidance to the EU texts; omit for EU texts only."
    }
  },
  "required": [
    "question"
  ],
  "additionalProperties": false
}

Lists the GDPR obligations of a company established in an EU or EEA country from a few facts (size, website and cookies, e-mail marketing, sensitive data, video surveillance, AI...). Deterministic rules: each obligation comes with its legal basis and a suggested search_law query for the official text. A fact left out is treated as unknown, except processors, which are assumed.

{
  "type": "object",
  "properties": {
    "country": {
      "type": "string",
      "enum": [
        "AT",
        "BE",
        "BG",
        "HR",
        "CY",
        "CZ",
        "DK",
        "EE",
        "FI",
        "FR",
        "DE",
        "GR",
        "HU",
        "IE",
        "IT",
        "LV",
        "LT",
        "LU",
        "MT",
        "NL",
        "PL",
        "PT",
        "RO",
        "SK",
        "SI",
        "ES",
        "SE",
        "IS",
        "LI",
        "NO"
      ],
      "description": "Country where the company is established (ISO code of an EU or EEA country, e.g. FR, DE, ES, IT)."
    },
    "employees": {
      "type": "integer",
      "minimum": 0,
      "maximum": 1000000,
      "description": "Number of employees (0 if none)."
    },
    "public_sector": {
      "type": "boolean",
      "description": "True if the organisation is a public authority or public body."
    },
    "website": {
      "type": "boolean",
      "description": "True if the company has a website or app."
    },
    "non_essential_cookies": {
      "type": "boolean",
      "description": "True if the website or app uses non-essential cookies or trackers (analytics, advertising, social media pixels)."
    },
    "email_marketing": {
      "type": "boolean",
      "description": "True if the company sends marketing e-mails or SMS to individuals."
    },
    "processors": {
      "type": "boolean",
      "description": "True if providers process personal data on its behalf (hosting, SaaS, payroll, CRM). Assumed true if omitted."
    },
    "transfers_outside_eea": {
      "type": "boolean",
      "description": "True if personal data is sent to providers or entities outside the EEA (e.g. US SaaS)."
    },
    "special_category_data": {
      "type": "boolean",
      "description": "True if it processes special category data (health, biometrics, genetic data, religion, union membership, sex life or orientation, ethnic origin, political opinions)."
    },
    "large_scale": {
      "type": "boolean",
      "description": "True if the processing concerns a large number of people (large scale)."
    },
    "systematic_monitoring": {
      "type": "boolean",
      "description": "True if it systematically monitors people (online behaviour tracking, geolocation, profiling for advertising, CCTV of public areas)."
    },
    "evaluation_or_scoring": {
      "type": "boolean",
      "description": "True if it evaluates or scores people (credit scoring, profiling, performance rating)."
    },
    "automated_decisions": {
      "type": "boolean",
      "description": "True if it takes automated decisions with legal or similarly significant effects on people."
    },
    "vulnerable_people": {
      "type": "boolean",
      "description": "True if it processes data of vulnerable people (children, patients, elderly people)."
    },
    "cctv": {
      "type": "boolean",
      "description": "True if it uses video surveillance (CCTV)."
    },
    "ai": {
      "type": "boolean",
      "description": "True if it develops or uses AI systems that interact with or make decisions about people."
    }
  },
  "required": [
    "country"
  ],
  "additionalProperties": false
}

Saves one entry of the record of processing activities (GDPR art. 30(1)) in the Hermetics account linked to the connection: new records get a code and every change is kept as a new version, in the account's own register on the Hermetics platform (the free account has no DPO: the user checks the records). When the account belongs to a Hermetics client organization, records go to that organization's register on the Hermetics platform (codes AT-001...), pending its DPO's review; a change to a record the DPO has validated is sent to the DPO as a proposal. Returns the code, the version and the points a DPO would review in the entry; when an existing record is updated, also what changed from the previous version and what the change requires (information notice, proof of consent, processor contract, transfer safeguard, DPIA review). The free account stores 3 records, the plans without a DPO up to 200, the designated DPO plan without limit.

{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "minLength": 3,
      "maxLength": 150,
      "description": "Short name of the processing activity (e.g. \"Payroll\", \"Newsletter\")."
    },
    "purpose": {
      "type": "string",
      "minLength": 10,
      "maxLength": 1000,
      "description": "Purpose of the processing (art. 30(1)(b))."
    },
    "legal_basis": {
      "type": "string",
      "enum": [
        "consent",
        "contract",
        "legal_obligation",
        "vital_interests",
        "public_task",
        "legitimate_interests"
      ],
      "description": "Legal basis under art. 6(1)."
    },
    "legal_basis_details": {
      "type": "string",
      "maxLength": 1000,
      "description": "Details of the legal basis: the legal obligation, the contract, or the legitimate interest pursued."
    },
    "data_subjects": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      },
      "minItems": 1,
      "maxItems": 30,
      "description": "Categories of data subjects (art. 30(1)(c)), e.g. \"employees\", \"customers\"."
    },
    "data_categories": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      },
      "minItems": 1,
      "maxItems": 30,
      "description": "Categories of personal data (art. 30(1)(c)), e.g. \"identity\", \"bank details\"."
    },
    "special_category_data": {
      "type": "boolean",
      "description": "True if special category data (art. 9) are processed."
    },
    "art9_exception": {
      "type": "string",
      "maxLength": 500,
      "description": "The art. 9(2) exception relied on, if special category data are processed."
    },
    "recipients": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      },
      "minItems": 1,
      "maxItems": 30,
      "description": "Categories of recipients, internal and external (art. 30(1)(d))."
    },
    "processors": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      },
      "maxItems": 30,
      "description": "Processors acting on behalf of the company (art. 28)."
    },
    "transfers_outside_eea": {
      "type": "object",
      "properties": {
        "countries": {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 2,
            "maxLength": 100
          },
          "minItems": 1,
          "maxItems": 30
        },
        "safeguard": {
          "type": "string",
          "maxLength": 300,
          "description": "Adequacy decision, standard contractual clauses, etc. (art. 44 to 49)."
        }
      },
      "required": [
        "countries"
      ],
      "additionalProperties": false,
      "description": "Transfers to third countries (art. 30(1)(e)); omit if none."
    },
    "retention": {
      "type": "string",
      "minLength": 3,
      "maxLength": 500,
      "description": "Retention period or the criteria used to determine it (art. 30(1)(f))."
    },
    "security_measures": {
      "type": "array",
      "items": {
        "type": "string",
        "minLength": 1,
        "maxLength": 200
      },
      "maxItems": 30,
      "description": "General description of technical and organisational security measures (art. 30(1)(g))."
    },
    "record_id": {
      "type": "string",
      "description": "Code of an existing record (e.g. RT-001, or AT-001 in an organization register) to save a new version of it; omit to create a new record."
    }
  },
  "required": [
    "name",
    "purpose",
    "legal_basis",
    "data_subjects",
    "data_categories",
    "recipients",
    "retention"
  ],
  "additionalProperties": false
}

Lists the records of processing activities (GDPR art. 30(1)) saved in the Hermetics account linked to the connection, in their latest version, with their full content. For an account of a Hermetics client organization, lists the organization's whole register on the Hermetics platform, whatever the origin of each record, with its status.

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}

Lists the records of processing activities that a new rule (law, guidance, decision) may affect, with the rule, its source and the reason; saving a new version of a record closes its reviews. Reviews are part of the paid plans.

{
  "type": "object",
  "properties": {},
  "additionalProperties": false
}