LegalAI[Space]

Privacy & Data Protection Agent

Your whole UK GDPR practice in one agent: DSARs, DPAs, DPIAs and triage

Privacy & Data Protection

Assesses data protection questions and breach responses against UK and EU GDPR.

Start freeBook a walkthrough

No credit card required

Agents · Contract Agent · Employment Contract Compliance ReviewCompleted

  • Replace the UK/Ireland/EU non-compete with a 3 to 6 month restriction tied to competing corporate-law work.

  • Replace blanket data consent with a lawful-basis clause and a separate monitoring notice.

  • Remove the five-day carry-over cap and reference the statutory carry-over rules.

  • Narrow the client non-solicit to clients dealt with in the final 12 months.

  • Add an explicit working-time opt-out withdrawal mechanism.

  • Confirm the bonus clause states the discretion is exercised in good faith.

You hand it

  1. 01Assess a personal data breach for notification duties
  2. 02Review a privacy notice against UK GDPR requirements
  3. 03Answer a data-sharing question with the applicable lawful basis

You get back

A memo with the assessment, the notification duties and deadlines identified, authorities with verdicts, and open questions.

  • Summary
  • Files
  • Action items
  • Authorities
  • Open questions
  • How this was made

You can rely on it because

It runs inside the matter, reads only what is on the file, and records every step under How this was made.

From the task to the draft.

The Privacy & Data Protection Agent assesses questions against the UK GDPR, the Data Protection Act 2018 and EU GDPR, and can run a breach-notification assessment, working out whether a notification to the ICO or affected individuals is required and to what timeline.

  1. 01

    Describe the task

    Describe the task: a DSAR, a DPA to review, a new processing activity, or a triage question.

  2. 02

    Load the matching skill

    The agent loads the matching skill and runs the workflow: computing deadlines, screening, or redlining.

  3. 03

    Screen and verify

    PII Redaction and Privilege Review run automatically, and citations are verified on demand.

  4. 04

    Receive the draft

    Receive a draft: an acknowledgement, a response pack, a redline list, a DPIA, or a triage decision.

  5. 05

    The DPO reviews and sends

    The DPO reviews, decides and sends; every output is a draft, not a final position.

A document with its working attached.

A memo with the assessment, the notification duties and deadlines identified, authorities with verdicts, and open questions.
Agents · Contract Agent · Employment Contract Compliance ReviewCompleted
6 items need your confirmation14 authorities · Where we looked

Senior Associate Employment Contract: English Law Review

Summary

  1. 1.

    Clause 9(c), non-competeHigh

    The 12-month prohibition on working for any law firm anywhere in the UK, Ireland or EU, in any capacity, is almost certainly wider than reasonably necessary and therefore unlikely to be enforceable.

    Tillman v Egon Zehnder Ltd [2019] UKSC 32
  2. 2.

    Clause 11, data and monitoringHigh

    Blanket contractual consent is not an adequate basis for general employment processing, special-category data or unrestricted monitoring.

    UK GDPR, Arts 6 and 9
  3. 3.

    Clause 4, holiday carry-overHigh

    The unconditional five-day cap conflicts with mandatory carry-over rights where sickness, statutory leave or employer failure prevents leave being taken.

    Working Time Regulations 1998, regs 13 to 13A

Three tasks to start with.

The prompts the agent suggests inside the workspace. Paste your own document under any of them.

  • Respond to a DSAR

    Log this subject access request, compute the statutory deadline, apply the relevant DPA 2018 exemptions, and draft a redaction log and response pack:

  • Review a DPA under Article 28

    Review this data processing agreement against Article 28 UK GDPR from the controller's side. Check every mandatory term and the transfer mechanism, and propose redlines:

  • Run a DPIA or triage

    Screen this new processing activity: proceed, PIA or DPIA. If a DPIA is needed, build the risk register and the Article 36 consultation decision:

Run one on your document

Who it is for, and what it will not do yet.

Best for

  • DPOs and privacy teams who want one agent for the whole UK GDPR workflow.
  • Anyone running a DSAR against the one-month statutory clock.
  • Teams triaging a new processing activity before it needs a full DPIA.

Not yet

  • The DPO reviews, decides and sends every output: nothing is submitted to the ICO or a data subject automatically.
Under the hoodProtocols, gates, skills and sources, for the reader who wants them.

Protocols

  1. 01Planning ProtocolMaps out the plan before any work starts: which sources answer which part of the task, in what order.
  2. 02Legal Citation VerifierIndependently re-fetches every cited authority and confirms it exists and reads as quoted before the memo reaches you.
  3. 03Privilege ReviewAssesses the output for privileged or confidential material and flags disclosure risk before it is circulated.
  4. 04PII RedactionScreens the task for personal and client data and redacts it before dispatch, with an allow-list so the firm's own name is not stripped from its own memo.
  5. 05Jurisdiction GatekeeperConfirms the task sits inside a jurisdiction the firm has enabled, and flags anything that strays outside it.

Skills

  • Privilege & Confidentiality
  • Data Protection (UK GDPR & Privacy)
  • DSAR Handling (UK GDPR)
  • DPIA Methodology (UK GDPR Art 35)

Connectors in the catalogue

Catalogue tiles, not live integrations today. Documents are uploaded to the matter.

  • Definely
  • Microsoft 365
  • Google Drive
  • OpenLaw

See it do real work.

  1. 01A personal data breach, the 72-hour assessmentAn export containing HR records for 214 people was sent to the wrong address. The Article 33 clock started at awareness, and the assessment has to be defensible within the 72-hour window, whichever way the decision goes.
  2. 02Review a reseller agreement governed by Singapore lawA London software business is appointing a reseller in Singapore and the reseller has proposed its own local paper. The review covers appointment scope, customer data handling and termination, and states plainly how the research was sourced.
  3. 03Run a DPIA on a new staff monitoring toolAn operations team wants to install activity monitoring software on every laptop and has asked legal to sign it off. The assessment works through the processing as described, the lawful basis available and the risks that would remain after mitigation.
  4. 04Answer a subject access request under Irish lawAn employee in Dublin who is midway through a grievance has made a broad subject access request covering four years of email. The run scopes the request, applies the exemptions and produces the response letter.
  5. 05Assess an international transfer under the standard clausesA European insurer is moving first-line customer support to a provider outside the EEA and the provider has sent signed standard clauses. The assessment checks the module, the annexes and whether the clauses alone are enough in the destination.
  6. 06Audit a cookie banner against the tracking rulesA retailer's site sets forty-one trackers and its cookie policy describes eleven. The audit reads the tracker inventory against the banner behaviour and the policy, and reports where the three do not match.
  7. 07Review processor terms against Article 28A supplier has refused to sign the client's data processing addendum and offered its own instead. The review compares the supplier's terms with what the law requires and produces the shortest set of amendments that would make them acceptable.

Other agents