You can connect an AI app that you already use, such as ChatGPT, Microsoft 365 Copilot, Claude or Cursor, to your GDPRWise dossier. You paste one web address into the AI app, sign in with your own GDPRWise account, and confirm once. From then on you can ask that AI app about your own processes, third parties and compliance status, and about the GDPRWise help articles. If you allow it, the AI app can also propose changes to your register and keep your compliance items up to date.
Not sure where to start? Paste this into the AI app you want to connect, and it will walk you through the steps.
If the Configuration page in GDPRWise shows a different address, use that one in the prompt.
The address to paste
The address is shown on the Configuration page in GDPRWise, in the card “AI app connections”, with a copy button. Only the account owner sees that card. For GDPRWise it looks like this:
https://api.gdprwise.eu/mcpCopy the address from the card, because partners and other brands can have their own. If you are not the account owner, ask them for it.
How to connect, per AI app
The menus of AI apps change often, so these steps stay short. Your AI app’s own help pages have the current screens.
- ChatGPT. Turn on developer mode in the settings, add a new connector, paste the address and choose OAuth as the sign-in method. Developer mode is only available on some ChatGPT plans.
- Microsoft 365 Copilot. Your Microsoft 365 administrator adds the address as an MCP connection in Copilot Studio. A ready-made Copilot agent for GDPRWise is not available yet.
- Claude. In Claude on the web or desktop, open the connector settings, add a custom connector and paste the address. On a team plan an administrator may need to add it first. In Claude Code, run
claude mcp add --transport http gdprwise <address>and then sign in through the/mcpcommand. - Cursor. Add a server with the address to your
mcp.jsonfile, undermcpServers, with theurlsetting. Cursor then opens a sign-in page.
In every case a GDPRWise page opens in your browser. It shows which app asks for access and, if the app asks to make changes, what it may change. Check that, then choose Continue, or allow read-only access if you only want the app to look things up.
Read, or read and change
You choose the access when you connect:
- Read. The AI app looks things up in your dossier and in the GDPRWise help articles. It cannot change anything.
- Read and change. The AI app can also make the changes described below. Every change is recorded under the AI app’s name.
Only verified apps can get read and change access: ChatGPT, Claude on the web or desktop, and Microsoft 365 Copilot. Cursor, Claude Code and any other app get read access only, and the GDPRWise page you see when you connect says so. When an app asks for change access, that page lists what it may change and offers a button to allow read-only access instead.
The account owner sees on the Configuration page, in the card “AI app connections”, which access each person’s connection has and how many suggestions are waiting for review.
What an AI app can change
With read and change access, the AI app can do two things.
Propose changes to your register. It can suggest adding or removing data categories, processes and systems, adding third parties, linking a system to a process or a third party, recording whether a system has AI features, and recording a system’s vendor. A third party can only be added from the GDPRWise catalogue. These changes never go into your dossier directly. They wait as suggestions that a person reviews, either on the normal screens in GDPRWise or in the AI app. GDPRWise tells the AI app to approve or reject a suggestion only after you have confirmed which one in the conversation, and to name each one exactly as GDPRWise shows it. An approved third party is saved as a draft: nothing is sent to that third party.
Update compliance items. It can set a compliance item to not started, in progress or done, assign it to yourself, to nobody or to the one team member who holds a role, such as the GDPR coordinator, and add a plain-text note. This change is made directly, so GDPRWise tells the AI app to ask you to confirm it first. It cannot assign an item to a colleague by name, and a note cannot mention colleagues, so no one gets an email because of it.
Everything else, such as removing a third party, editing text in the register or sending agreements, still goes through the normal screens in GDPRWise.
Which companies it reaches
You connect an AI app once, with your own account, and it sees only what that account can already see in GDPRWise. The connection covers every company you are a member of, now and in the future, as long as that company’s account owner allows AI app connections. Each time the AI app looks something up it names the company, and GDPRWise checks, on that very call, that you are still an active member, that the company’s plan includes the AI assistant and that its owner has not switched AI app connections off. If you work for several companies, the AI app first asks GDPRWise which companies you can use. To check which GDPRWise account an AI app is connected with, just ask it: it receives your name and email address along with that list.
What is sent to the AI app
When the AI app looks something up, GDPRWise sends it:
- your GDPR register: processes, systems, data categories and third parties
- your compliance status and next steps
- your organisation profile, including the names and roles of team members
- GDPRWise help articles
Text that you and your colleagues wrote in the register is sent whenever the AI app looks something up. Email addresses and phone numbers are pseudonymised: they are replaced by labels. That is not anonymisation. Pseudonymised data is still personal data under the GDPR, and names, roles and free text are sent as they are.
Nothing is sent while the AI app is not looking something up.
Who processes it
Your questions and the answers are processed by the provider of the AI app, such as OpenAI (ChatGPT), Microsoft (Microsoft 365 Copilot) or Anthropic (Claude), under that provider’s own terms. By connecting the app, you choose that provider as a recipient of the data. GDPRWise does not choose it and does not pay for it, so it is not a GDPRWise sub-processor. Check the terms and the data settings of your AI plan before you connect, and record the provider in your register as a recipient.
The risk that remains
An AI app reads text and may act on instructions hidden in that text. If a document, a web page or a note in the register contains such instructions, the AI app might follow them. If other connectors are active in the same app, the app could pass on what it read from GDPRWise. GDPRWise cannot prevent this, because it does not control the AI app. With read and change access, such instructions could also lead the AI app to propose changes or to ask you to confirm one. Register changes still wait for a person to review them, but a compliance item changes as soon as you confirm, so read what the AI app asks you to confirm. To keep the risk small, connect only AI apps your organisation already trusts, choose read access if you do not need changes, avoid combining the connection with connectors that can send data out, and keep free text in the register factual.
How to disconnect
- Yourself. To stop an AI app reaching GDPRWise, disconnect it in that app’s settings. Changing your GDPRWise password also disconnects every AI app. To take change access away, disconnect the app, connect it again and allow read-only access.
- The whole company. An account owner controls this with one switch on the Configuration page. Off blocks every AI app from reaching that company immediately, including resellers’ agents. On restores existing connections.
- Automatically. A connection ends when you change or reset your password, and after 30 days without use, or 90 days after you first connected, whichever comes first. An AI app can no longer reach a company once your access to that company is removed or suspended.
Usage
Searches made by the AI app count towards the same daily AI usage limit as the in-app assistant. The Configuration page shows how much of the limit is used today.
Find out how your website scores on privacy in just a few minutes. No prior knowledge needed.