Know every byte of personal data
your AI sends — before regulators do.

GDPR Oversight sits between your users, your agents, and the cloud AI endpoints they call — OpenAI, Anthropic, Google, Azure OpenAI, and others. Every outbound LLM API call passes through the gateway. We scan the request payload for personal data categories (names, email addresses, national ID numbers, health data, financial data, location data, and other Article 4 GDPR categories), classify the risk level, and decide in real time whether to pass, alert, redact, or block. The system produces an immutable egress event record for every call, regardless of the action taken. This log is the foundation of your Article 33 breach notification evidence package.

GDPR Oversight deploys as a transparent proxy in front of your LLM API calls — no changes to your application code required in most cases. For organisations already routing LLM calls through an API gateway, we integrate at that layer. For direct SDK usage, we provide lightweight SDK wrappers for the major providers. We also support webhook-based integration for alerting into existing SIEM, DLP, or incident management systems (Splunk, Datadog, PagerDuty, Jira Service Management). The DPO dashboard is a standalone web application requiring no infrastructure on your side.

The state machine executes in under 100ms. For a high-risk event: the request is blocked before it reaches the LLM provider; an immutable breach record is written with full context (timestamp, source system, destination endpoint, PII categories detected, user/agent identity); the DPO receives an automated alert via email and dashboard notification; and the 72-hour Article 33 clock is noted in the breach register. For medium-risk events, the default action is to alert without blocking — this is configurable per policy rule. The DPO can review, escalate, dismiss, or initiate a formal breach notification workflow directly from the dashboard.

Yes. GDPR Oversight supports logical tenant isolation within a single deployment — relevant for holding groups, law firms with multiple practice areas, or SaaS providers processing data on behalf of multiple controllers. Each tenant has its own policy rules, egress event log, breach register, and DPO notification settings. Cross-tenant data cannot be accessed by tenant-level users. Platform administrators can see aggregated metrics without accessing individual tenant data. Data processor agreements, sub-processor lists, and record-of-processing activities can be scoped per tenant.

PII classification accuracy depends on the classifier engine configured for your deployment — we support multiple options including Microsoft Presidio, AWS Comprehend, and fine-tuned transformer-based classifiers. In production deployments across European financial services clients, we achieve over 97% recall on structured PII (names, emails, IDs, IBANs) and over 91% recall on unstructured contextual PII (health conditions mentioned in free text, implicit location references). False positive rates are configurable: stricter detection increases false positives on benign data; we tune the threshold per data category based on your risk appetite and the volume of edge cases your team can review.

Yes — by design. GDPR Oversight can be deployed fully on-premise or in a private cloud within your jurisdiction, so no personal data passes through our infrastructure. The breach register, egress event logs, and policy configuration are stored in your environment only. For cloud-hosted deployments, we sign a data processor agreement covering our processing role, sub-processor list, and data residency commitments. We do not use customer data for model training, product improvement, or any purpose beyond the contracted service. Our own internal data processing activities are documented and available to DPOs on request.