DPIA · Claude connector
DPIA with Claude: the intake in four steps
With the Praxikon connector, Claude has your processing checked against Article 35 GDPR, the DPIA list of the Dutch Data Protection Authority and the AI Act. You get the outcome with the article and the source, and the DPIA intake as a Word file, with a FRIA draft where Article 27 AI Act applies.
Free, no account and no login.
Made by Zahed Ashkara, AI and privacy legal adviser
How it works
From question to DPIA intake in Claude
- 01
Connect Praxikon to Claude
Open the Praxikon listing in the Claude directory and choose Connect. Or go to Settings, Connectors in Claude, choose Add custom connector and paste the address. Whether this is available depends on your Claude plan.
- 02
Ask your question
In a new chat, describe what you plan to do, in general terms and without names. For example:
Example question
“We want AI to analyse camera footage in our shops to detect theft. Is a DPIA required, and what does the AI Act say? Then prepare the DPIA intake as a Word file.”
- 03
Answer the fixed questions
Claude turns your description into the fixed choices of the case check: type of organisation, your role, AI and personal data, the purpose, profiling, the scale and the categories of the Dutch DPA list. If a fact is missing, Claude asks for it. What you do not know stays an open question and never becomes a no.
- 04
Download the DPIA intake as a Word file
Ask Claude for the DPIA intake. You get a link to the case check on the site with your answers in it. There you find the button Download DPIA intake (Word), and where a FRIA applies one for the FRIA too. The file is built in your own browser.
What you get
A DPIA intake, a FRIA draft and an outcome with sources
The same rules as the case check on the site, with no language model on our side: the same facts always give the same outcome.
- Art. 35(7) GDPR
- DPIA intake in the four parts, with the 17 points of the Dutch central government DPIA model. Each point is filled, partly filled or open.
- Art. 27(1) AI Act
- FRIA draft, points (a) to (f), built on the same facts. Only where a FRIA applies; otherwise the reason is given.
- outcome with source
- The outcome per law, with the article, the date an obligation applies and a link to the official text. What is unknown stays an open question.
The law
When is a DPIA required, and when a FRIA?
A DPIA is required when processing personal data is likely to result in a high risk to the rights and freedoms of people. You carry it out before the processing starts (Article 35(1) GDPR).
The GDPR names three cases in which a DPIA is required in any event: a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; large scale processing of special categories of data or criminal offence data; and systematic monitoring of a publicly accessible area on a large scale (Article 35(3)).
Each supervisory authority also publishes a list of processing operations that require a DPIA (Article 35(4)). The list of the Dutch Data Protection Authority names seventeen, such as fraud prevention, credit scores, profiling, camera surveillance, employee monitoring and biometric data. The list is not exhaustive.
If your processing is not on the list, the nine criteria in the DPIA guidelines of the European data protection authorities help: processing that meets two or more of them requires a DPIA in most cases. The Praxikon case check follows that order: Article 35(3)(a) and (b), the list, then the criteria.
A FRIA (Article 27 AI Act) stands next to it. It applies only to the deployer of a high-risk AI system under Annex III, and then only to bodies governed by public law, private entities providing public services, and deployers using the system to evaluate the creditworthiness or credit score of natural persons (not to detect financial fraud) or for risk assessment and pricing of natural persons in life and health insurance. Critical infrastructure (Annex III point 2) is excluded. Where the DPIA already meets an obligation of the FRIA, you may cross-refer to those parts or include them in the FRIA (Article 27(4)).
Article 35 GDPR explainedArticle 27 AI Act explained
Sources
- GDPR, Regulation (EU) 2016/679, Article 35
- Dutch Data Protection Authority, decision on the list of processing operations requiring a DPIA (Stcrt. 2019, 64418), in Dutch
- EDPB, Guidelines on Data Protection Impact Assessment (WP248 rev.01)
- Kenniscentrum voor beleid en regelgeving (KCBR), Model DPIA Rijksdienst, version August 2026 (Dutch government DPIA model, in Dutch)
- AI Act, Regulation (EU) 2024/1689, consolidated text of 27 July 2026, Article 27
Privacy
Do not paste names or personal data
- Describe the processing in general terms. Names, email addresses and other personal data are not needed for the check, so do not paste them into your question.
- Of your question, Praxikon receives only fixed answer codes, such as “domain: recruitment” or “personal data: yes”, or for a short general question that question alone, at most 200 characters. The case check and the DPIA intake have no field for free text, names or an organisation name.
- Praxikon does not store your question, your answers or the Word file, and does not log the content. We do keep an anonymous daily count, including the function, the kind of assistant, the language and, for the case check, the type of organisation and the domain.
- What your assistant itself keeps of the conversation falls under that provider’s terms.
More in section 2.7 of the privacy statement.
Questions
Frequently asked questions
Can Claude do a DPIA for me?
With Praxikon, Claude prepares the DPIA intake, not the whole DPIA. The connector checks your facts with fixed rules against Article 35 GDPR and the list of the Dutch Data Protection Authority, and returns the intake as a Word file: the four parts of Article 35(7) with the 17 points of the Dutch central government DPIA model. You complete and adopt the DPIA itself as the controller.
Is Praxikon a Claude connector or an MCP server?
Both. In the Claude directory Praxikon is a connector; technically it is an MCP server under the open Model Context Protocol. In ChatGPT the same connection is a plugin.
Does it work with a free Claude account?
That depends on your Claude plan, and it can change. The listing in the Claude directory shows whether you can connect. If you cannot, run the DPIA intake on the site.
Does it work in the Claude app and in Claude Code?
Yes. You connect Praxikon through the Claude directory and then use the connector in Claude on the web, in the desktop app and on mobile. For Claude Code there is one command; it is on the page about the MCP server.
When is a FRIA draft included?
When Article 27 AI Act applies: for a high-risk AI system under Annex III, except critical infrastructure (point 2), that the deployer uses as a body governed by public law or a private entity providing a public service, or to evaluate the creditworthiness of natural persons (not to detect fraud) or for risk assessment and pricing in life and health insurance. You then get a FRIA draft with points (a) to (f) next to the DPIA intake. Where no FRIA applies, the reason is given.
What does Praxikon see of my Claude conversation?
Of the content of your conversation, only what Claude sends for a function: fixed answer codes about your processing, or for a short general question that question, at most 200 characters. Praxikon refuses a question that looks like personal data. Praxikon does not store this and does not log the content. How Praxikon recognises the kind of assistant and what it counts anonymously is set out in section 2.7 of the privacy statement. What Claude itself keeps of the conversation falls under the terms of Anthropic.
More
More on Praxikon in your AI assistant
- DPIA with ChatGPT
Add the plugin, answer the fixed questions and download the DPIA intake as a Word file.
- GDPR and AI Act MCP server
Address, transport, the nine tools and installation in Claude Code, Cursor, VS Code, Copilot Studio and Le Chat.
- All assistants
How to add Praxikon to every assistant, three example questions and what it does and does not do.
Not legal advice: a legal adviser signs
Praxikon prepares, it does not advise. The outcome is general information based on fixed rules, not a decision about your organisation, and Praxikon is not a supervisory authority. The DPIA itself remains the responsibility of the controller. If you want a DPIA or FRIA that a legal adviser reviews and signs, choose the signed assessment.