GDPR DPIA Assistant with RAG and Kestra AI

id: ai-gdpr-dpia-assistant
namespace: company.legal

description: |
  GDPR Data Protection Impact Assessment (DPIA) assistant using RAG
  on official GDPR regulation text.

inputs:
  - id: processing_activity
    type: STRING
    displayName: Describe the data processing activity
    defaults: |
      We plan to deploy an AI-powered employee monitoring system that
      tracks screen activity, keystroke patterns, and application usage
      to measure productivity. Data is stored in an EU-hosted cloud for
      12 months and shared with department managers.

  - id: data_categories
    type: SELECT
    displayName: Categories of personal data involved
    defaults: Employee behavioral data
    values:
      - Employee behavioral data
      - Customer transaction data
      - Health and biometric data
      - Children's data
      - Location and tracking data
      - Criminal offence data
      - Large-scale profiling data

tasks:
  # Step 1, Ingest the official GDPR regulation text into a vector store
  # for Retrieval-Augmented Generation (RAG). This ensures the agent's
  # analysis is grounded in the actual legal text, not hallucinated.
  - id: ingest_gdpr_text
    type: io.kestra.plugin.ai.rag.IngestDocument
    description: Ingest official GDPR regulation into vector embeddings for RAG
    provider:
      type: io.kestra.plugin.ai.provider.MistralAI
      modelName: mistral-embed
    embeddings:
      type: io.kestra.plugin.ai.embeddings.KestraKVStore
    drop: true
    documentSplitter:
      maxSegmentSizeInChars: 1000
      maxOverlapSizeInChars: 200
      splitter: RECURSIVE
    fromExternalURLs:
      - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679&format=TXT
      - https://www.edpb.europa.eu/system/files/2024-02/edpb_guidelines_042023_calculationofadministrativefines_en.pdf

  # Step 2, Run a DPIA assessment grounded in the ingested GDPR articles.
  # The agent retrieves relevant articles from the vector store and uses
  # web search to find recent EDPB guidelines and DPA enforcement decisions.
  - id: dpia_assessment
    type: io.kestra.plugin.ai.rag.ChatCompletion
    description: Generate a DPIA report grounded in GDPR articles and EDPB guidance
    chatProvider:
      type: io.kestra.plugin.ai.provider.MistralAI
      # Mistral Large, a European AI model hosted in EU data centers by
      # Mistral AI (Paris, France). Choosing an EU-based provider is a
      # deliberate data sovereignty decision: legal prompts containing
      # personal data descriptions stay within EU jurisdiction.
      #
      # Alternative: use a LOCAL model for full air-gapped compliance:
      #   type: io.kestra.plugin.ai.provider.Ollama
      #   endpoint: http://ollama:11434
      #   modelName: mistral-large
      modelName: mistral-large-2512
    embeddingProvider:
      type: io.kestra.plugin.ai.provider.MistralAI
      modelName: mistral-embed
    embeddings:
      type: io.kestra.plugin.ai.embeddings.KestraKVStore
    contentRetrievers:
      - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
        maxResults: 5
    chatConfiguration:
      temperature: 0.1
      maxToken: 4096
    systemMessage: |
      You are a senior Data Protection Officer and GDPR legal expert.
      You conduct Data Protection Impact Assessments (DPIAs) as required
      by Article 35 of the GDPR.

      IMPORTANT RULES:
      - ALWAYS cite specific GDPR articles (e.g., "Article 35(3)(a)")
      - Reference relevant EDPB guidelines and WP29 opinions when applicable
      - Use the retrieved GDPR text as your primary legal source
      - Use web search results for recent enforcement decisions and guidance
      - Be precise about legal obligations vs. recommendations
      - Flag any processing that would require prior consultation with the
        supervisory authority under Article 36
      - Output in structured Markdown format
    prompt: |
      Conduct a full DPIA for the following processing activity:

      PROCESSING ACTIVITY: {{ inputs.processing_activity }}
      DATA CATEGORIES: {{ inputs.data_categories }}

      Structure your assessment as follows:

      ## 1. DPIA Necessity Assessment
      Determine whether a DPIA is mandatory under Article 35(3) and EDPB
      guidelines. List each triggering criterion that applies.

      ## 2. Systematic Description of Processing (Article 35(7)(a))
      - Purpose and legal basis (Article 6, and Article 9 if special categories)
      - Data subjects and data types
      - Data recipients and transfers (Chapter V implications)
      - Retention period and storage location

      ## 3. Necessity and Proportionality (Article 35(7)(b))
      - Is the processing necessary for the stated purpose?
      - Could the purpose be achieved with less data (data minimisation, Art. 5(1)(c))?
      - What is the legal basis and is it sufficient?

      ## 4. Risk Assessment (Article 35(7)(c))
      For each identified risk, assess:
      - Likelihood (Low / Medium / High)
      - Severity (Low / Medium / High)
      - Risk level (combining both)
      - Affected rights and freedoms

      ## 5. Mitigation Measures (Article 35(7)(d))
      Propose specific technical and organisational measures:
      - Technical safeguards (encryption, pseudonymisation, access controls)
      - Organisational measures (policies, training, DPO involvement)
      - Data subject rights mechanisms (Article 12-22)

      ## 6. Residual Risk & Prior Consultation
      - Assess remaining risk after mitigation
      - State whether prior consultation under Article 36 is required
      - Recommend next steps

  # Step 3, Export the DPIA report to a Google Sheet for the legal register.
  # Each execution creates a new spreadsheet so the DPO can archive it.
  - id: format_report
    type: io.kestra.plugin.scripts.python.Script
    containerImage: python:3.11-slim
    inputFiles:
      report.md: "{{ outputs.dpia_assessment.outputText }}"
    outputFiles:
      - dpia_report.csv
    script: |
      import csv

      with open("report.md") as f:
          report = f.read()

      sections = [s.strip() for s in report.split("## ") if s.strip()]
      with open("dpia_report.csv", "w", newline="") as f:
          w = csv.writer(f)
          w.writerow(["Section", "Content"])
          for section in sections:
              parts = section.split("\n", 1)
              title = parts[0].strip()
              content = parts[1].strip() if len(parts) > 1 else ""
              w.writerow([title, content])

  - id: create_sheet
    type: io.kestra.plugin.googleworkspace.sheets.CreateSpreadsheet
    title: "DPIA, {{ inputs.data_categories }}, {{ now() | date('yyyy-MM-dd') }}"

  - id: load_report
    type: io.kestra.plugin.googleworkspace.sheets.Load
    spreadsheetId: "{{ outputs.create_sheet.spreadsheetId }}"
    from: "{{ outputs.format_report.outputFiles['dpia_report.csv'] }}"
    format: CSV
    range: "Sheet1"

  # Step 4, Notify the privacy-legal Slack channel with a link to the report.
  - id: notify_slack
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    messageText: "*DPIA Report Ready*

      *Processing Activity:* {{ inputs.processing_activity | truncate(120) }}

      *Data Categories:* {{ inputs.data_categories }}

      <{{ outputs.create_sheet.spreadsheetUrl }}|Open DPIA Report in Google
      Sheets>"

pluginDefaults:
  - type: io.kestra.plugin.ai.provider.MistralAI
    values:
      apiKey: "{{ secret('MISTRAL_API_KEY') }}"
  - type: io.kestra.plugin.ai.retriever.TavilyWebSearch
    values:
      apiKey: "{{ secret('TAVILY_API_KEY') }}"
  - type: io.kestra.plugin.googleworkspace.sheets.CreateSpreadsheet
    values:
      serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
  - type: io.kestra.plugin.googleworkspace.sheets.Load
    values:
      serviceAccount: "{{ secret('GCP_SERVICE_ACCOUNT_JSON') }}"
  - type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    values:
      url: "{{ secret('SLACK_WEBHOOK') }}"

Run a GDPR Data Protection Impact Assessment (DPIA) that is grounded in the actual law. This blueprint builds an AI DPIA assistant that uses Retrieval-Augmented Generation (RAG) over the official GDPR regulation text from EUR-Lex and EDPB fining guidelines, so the generated assessment cites real GDPR articles (Article 35, Article 36, Chapter V) instead of hallucinated legal references. It solves the core problem with generic LLM legal advice: outputs you cannot trust because they invent citations and miss the supervisory-authority obligations a Data Protection Officer is required to document.

How it works

ingest_gdpr_text (io.kestra.plugin.ai.rag.IngestDocument) downloads the official GDPR text and the EDPB administrative-fines guidelines, splits them with a RECURSIVE document splitter (1000-char segments, 200-char overlap), embeds them with mistral-embed, and stores the vectors in a io.kestra.plugin.ai.embeddings.KestraKVStore.
dpia_assessment (io.kestra.plugin.ai.rag.ChatCompletion) takes the processing_activity and data_categories inputs, retrieves the relevant articles from the vector store, augments them with live io.kestra.plugin.ai.retriever.TavilyWebSearch results for recent enforcement decisions, and generates a structured DPIA with mistral-large-2512 at temperature: 0.1.
format_report (io.kestra.plugin.scripts.python.Script) parses the Markdown report into a sectioned dpia_report.csv.
create_sheet and load_report (io.kestra.plugin.googleworkspace.sheets.CreateSpreadsheet and Load) create one Google Sheet per assessment and load the CSV for the legal register.
notify_slack (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) posts a link to the finished report for the privacy-legal channel.

What you get

A DPIA covering every Article 35(7) requirement: necessity, proportionality, risk assessment, and technical plus organisational mitigation measures.
Citations to the real GDPR text and EDPB guidance, not invented references.
An explicit flag for when Article 36 prior consultation is required.
An archived Google Sheet per assessment plus a Slack notification with the link.

Who it's for

Data Protection Officers running mandatory DPIAs before launching a system.
Legal and compliance teams reviewing high-risk processing activities.
Privacy consultants auditing client data processing operations.

Why orchestrate this with Kestra

A standalone AI chat call cannot rebuild a vector store, chain a retrieval step into web search, export to a register, and notify a team on a schedule or on an event. Kestra wires these as declarative YAML tasks with retries on flaky API calls, full execution lineage over every prompt and document ingested, and event triggers (a new processing activity submitted, a webhook, a flow trigger) that an LLM provider's own runtime has no concept of. You also keep model choice in your hands: the flow uses EU-hosted Mistral Large for data sovereignty and documents an Ollama local-model swap for air-gapped runs.

Prerequisites

A running Kestra instance and the AI, Google Workspace, and Slack plugins.

Secrets

MISTRAL_API_KEY: Mistral AI key used for chat and embeddings.
TAVILY_API_KEY: Tavily key for the web-search content retriever.
GCP_SERVICE_ACCOUNT_JSON: Google Cloud service account JSON with Sheets API access.
SLACK_WEBHOOK: Slack incoming webhook URL for the privacy-legal channel.

Quick start

Add the four secrets above to your Kestra instance.
Import this blueprint into a namespace such as company.legal.
Execute the flow, describing your processing_activity and selecting the data_categories.
Open the generated Google Sheet from the Slack message and review the DPIA.

How to extend

Swap mistral-large-2512 for an Ollama local model to run fully air-gapped.
Add national DPA guidance or your internal policies to fromExternalURLs.
Replace the Slack step with an email or ticketing task to route reports.
Add a schedule or webhook trigger to run DPIAs as part of an intake process.

Conduct a GDPR Data Protection Impact Assessment (DPIA) with RAG on Official Legal Texts

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Conduct a GDPR Data Protection Impact Assessment (DPIA) with RAG on Official Legal Texts

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More AI Blueprints

Generate AI Blog Posts in Your Brand Voice and Publish to WordPress as Draft

AI Annual Report Finder and Data Strategy Summary

Draft GDPR Breach Notifications for Supervisory Authorities and Data Subjects

Generate a book chapter summary using Perplexity AI and email it.

Trigger the Right Automation with an AI Agent Based on User Intent

Summarize Text with an AI Agent, Generate Multilingual Summaries in Short, Medium, or Long Format

New to Kestra?