Sandbox — Explore with sample data from Acme Corp
Start Free →
ComplianceHR Screening AgentAction Plan

Compliance Action Plan

Partial ComplianceScore: 41/100 Download PDF

GDPR AI — HR Screening Agent (hr-screening-agent) — assessed 5/3/2026

0% Complete0/7 items

GDPR AI Processing compliance: Partial Compliance (41%). DPIA has not been completed — this is likely required for AI processing of personal data. Automated decision-making with significant effects detected — Article 22 safeguards required.

Category: Partial Compliance

7
Total Items
3
Critical
3
High
0
In Progress
0
Completed
Assessment Inputs
2
Is there a clear lawful basis for processing personal data with this AI system?
2
How well does the AI system adhere to data minimization principles?
Has a Data Protection Impact Assessment (DPIA) been completed for this AI system?No
Does the AI system make automated decisions with legal or significant effects on individuals?Yes
1
Can the system provide meaningful explanations of AI-driven decisions to data subjects?
2
How well are data subject rights (access, erasure, portability) supported in the AI context?
3
Are cross-border data transfers for AI processing handled with appropriate safeguards?
2
Are data retention policies defined and enforced for AI training and inference data?

Remediation Items (7)

Establish Lawful Basis for AI Processing

critical

Document and validate the lawful basis under Article 6 for all personal data processing by this AI system.

GDPR Article 6 — Lawfulness of ProcessingWithin 14 days

Implement Data Minimization for AI

high

Ensure only necessary personal data is used in AI training and inference.

GDPR Article 5(1)(c) — Data MinimisationWithin 30 days

Complete Data Protection Impact Assessment

critical

Conduct a DPIA for this AI system's processing of personal data.

GDPR Article 35 — Data Protection Impact AssessmentWithin 21 days

Implement Article 22 Safeguards

critical

Ensure safeguards for automated decision-making with legal or significant effects.

GDPR Article 22 — Automated Decision-MakingWithin 21 days

Enable Right to Explanation for AI Decisions

high

Provide meaningful information about the logic of AI-driven decisions.

GDPR Articles 13-15, Recital 71Within 30 days

Support Data Subject Rights for AI Processing

high

Implement mechanisms for access, erasure, and portability in the AI context.

GDPR Articles 15-20 — Data Subject RightsWithin 45 days

Define AI Data Retention Policies

medium

Establish and enforce retention periods for AI training data, inference logs, and model artifacts.

GDPR Article 5(1)(e) — Storage LimitationWithin 60 days

Discussion

Review

This action plan is generated based on GDPR AI Processing Assessment requirements. It should be reviewed by your legal and compliance team. For definitive guidance, consult the official GDPR AI documentation.