GDPR gaps found, documents drafted, your sign-off.
Agents map your data flows, draft records of processing, DPIAs and policies from your own data, and list what is still open. Live for GDPR; ISO 27001 and the EU AI Act in preparation.
LiveRegulation (EU) 2016/679
From your website to an approved record.
The agent reads what you already have, fills in what GDPR asks, drafts the documents and hands each one to you for approval.
- 01
It researches
The agent reads your public website and the documents you upload, and lists every page it used.
- 02
It prefills the gap analysis
Company details, privacy policy, representatives and transfers are filled in from what it found. You check each answer.
- 03
It drafts the documents
The record of processing activities is written section by section, from the controller's details to the technical and organisational measures.
- 04
You approve
Nothing is final until a person on your team approves it. Approved documents stay in the library with their state.
The documents GDPR asks for.
Each one starts as a draft from your own information and becomes final only with your approval.
Records and assessments
- Record of processing activities (Art. 30)
- Data protection impact assessment (DPIA)
- Transfer impact assessment (TIA)
- Legitimate interest assessment (LIA)
- Fundamental rights impact assessment (FRIA, EU AI Act)
Contracts
- Data processing agreement (Art. 28)
- Joint controller agreement (Art. 26)
- Standard Contractual Clauses, all four modules
- Non-disclosure agreement
- Works council agreement
Notices and policies
- Privacy notice
- Cookie policy
- Technical and organisational measures (TOM)
- Data retention policy
- Data subject request procedure
- Consent form
Data breaches
- Notification to the supervisory authority
- Notification to affected people
- Breach register
- Breach response plan
What the agents work with.
Every draft rests on the same groundwork, and every one waits for a person on your team to approve it.
Legal research
Case law and supervisory-authority decisions.
Your company's profile
Enriched from your website and the documents you upload.
Questionnaire checklists
The gap analysis as questions, with packs for single industries.
Templates in English and Chinese
Drafts follow Marsstein's own English-Chinese template set.
For every company size.
The same agents for a founding team, a mid-size company with its DPO, a group of legal entities and a consultancy running GDPR for its clients.
Get GDPR-ready before your first enterprise deal.
Get the compliance work done without an enterprise budget. Built for founders who move fast.
Compliance without the enterprise overhead.
You're building a product, not a compliance department. Marsstein gives startups the compliance documentation larger companies buy from consultants, drafted by agents from your own context, at a price that fits a seed-stage budget. As the team grows, Marsstein grows with it.
Get the documents ready before the due diligence request.
Talk to us
- 01GDPR overload
GDPR has 99 articles and hundreds of requirements. For a founding team focused on product-market fit, it is hard to know where to start.
- 02Investor due diligence
VCs increasingly ask for GDPR compliance documentation during due diligence. Missing it can delay or kill a funding round.
- 03No legal budget
Privacy lawyers bill by the hour, and a GDPR project can cost more than a startup's legal budget for the year.
01When should a startup start thinking about GDPR?
02Do investors really check for GDPR compliance?
03What's the minimum GDPR compliance for a pre-seed startup?
04Can I use Marsstein if I'm a solo founder?
Take the GDPR paperwork off your team's desk.
Your data protection officer and team stay in charge. Marsstein agents take on the documentation work at a price that fits an SMB.
Your DPO decides. The agents do the groundwork.
A compliance project often ends with a binder of policies that ages as soon as regulations change. Marsstein works alongside your data protection officer, internal or external, and your team. AI agents research your company, draft the documentation and put open gaps on a list of tasks and risks, so your DPO can review and decide instead of starting from a blank page.
Give your DPO a first draft instead of a blank page.
Talk to us
- 01Employee data processing
Handling GDPR obligations for HR records, payroll and employee monitoring with little in-house legal capacity.
- 02Vendor and DPA management
Tracking data processing agreements across many SaaS tools, cloud providers and service vendors.
- 03Limited compliance budget
External GDPR audits and consulting projects are expensive, and many SMBs have no budget line for them.
01Does my SMB need a data protection officer (DPO)?
02How long does it take to get GDPR compliant with Marsstein?
03What if I already have some compliance documentation?
04How much does compliance typically cost for an SMB?
GDPR documentation for every entity you run.
Each legal entity gets its own isolated workspace. The agents draft its records, DPIAs and transfer documents; your team reviews and approves.
One workspace per entity, one team deciding.
Enterprise compliance fails when it is fragmented: different consultants for different subsidiaries, different tools for different frameworks. In Marsstein each legal entity gets its own isolated workspace, and the people you invite switch between them. The agents research each entity, prefill its gap analysis and draft its records, DPIAs, processing agreements, Standard Contractual Clauses and transfer impact assessments. Nothing is final until your team approves it. GDPR is covered today; ISO 27001 and the EU AI Act are in preparation.
Start with one entity, then add the rest.
Talk to us
- 01Multi-entity governance
Managing compliance across headquarters, subsidiaries, joint ventures and regional offices, each with different legal entities, jurisdictions and processing activities.
- 02International transfers
Every transfer outside the EU needs Standard Contractual Clauses and a transfer impact assessment, per entity and per recipient.
- 03AI system classification
The EU AI Act requires enterprises to inventory and classify all AI systems by risk level. That is a moving target as models are deployed across business units.
01How does Marsstein handle multi-entity compliance?
02What about enterprises with operations outside the EU?
Run GDPR for all your clients in one place.
One isolated workspace per client, one login for your team. The agents draft the GDPR documentation; your consultants review and decide.
Grow your compliance practice without growing headcount.
Compliance consulting is limited by billable hours. Marsstein takes over the documentation-heavy work: the agents research each client, prefill the gap analysis and draft client-specific records, Art. 28 processing agreements and Art. 26 joint controller agreements. Each client's data stays in its own workspace. Your consultants focus on advice while the agents handle the paperwork.
Bring one client engagement to a first call.
Talk to us
- 01Multi-client data segregation
Running compliance programs for several clients while keeping data strictly separated between engagements.
- 02Processor agreement complexity
As a processor for your clients, you need a GDPR Art. 28 compliant agreement for each engagement, each with its own scope, sub-processors and retention requirements.
- 03Joint controllership scenarios
Advisory engagements often create joint controller relationships under GDPR Art. 26, requiring a clear allocation of responsibility for processing activities.
01How does Marsstein handle multi-client environments?
02Can the agents draft joint controller agreements?
03What about sub-processors across clients?
Can EU test-drive footage go to China? One flow answers it.
For OEMs and suppliers with test fleets in Europe and R&D in China: when the GDPR transfer rules apply, what they require, and what China requires, with every source linked.
One question decides the path.
- 01
Is the data still personal after anonymization?
Assess the dataset, not only the frames: faces and plates masked, but can GPS, lidar, timestamps or vehicle IDs single out, link or infer a person (WP29 Opinion 05/2014)?
- 02
No: outside the GDPR
Anonymous data is outside the GDPR (Recital 26), so Chapter V does not apply. Keep the assessment on file; it is your evidence if the conclusion is questioned.
- 03
Yes: Chapter V applies
China has no adequacy decision. The transfer needs an Article 46 safeguard, typically standard contractual clauses (GDPR Chapter V).
- 04
The China side, on both paths
Without personal information or important data, data from activities such as international trade or multinational manufacturing is exempt from export filings (Article 3 of the 2024 CAC provisions). Personal information collected abroad, processed in China and sent back is exempt under Article 4, if no domestic personal information or important data is added.
If the data stays personal: the standard contractual clauses, in four steps.
- 01
Check whether the data stays personal
If the dataset is anonymous after assessment, Chapter V does not apply and no clauses are needed. The flow above shows the decision.
- 02
Choose the module
The clauses have four modules: controller to controller, controller to processor, processor to processor, processor to controller. Which one fits depends on who decides about the data in China.
- 03
Assess law and practice in China
Under Clause 14 the parties warrant that they have no reason to believe that the laws and practices of the destination country prevent compliance, taking into account the circumstances of the transfer and those laws and practices.
- 04
Document and keep watching
The assessment is documented and made available to the supervisory authority on request (Clause 14(d)); the importer notifies the exporter if it becomes subject to laws or practices that conflict (Clause 14(e)).
Transfer documentation, kept per dataset.
For every transfer outside the EU, the agents draft Standard Contractual Clauses (all four modules) and a transfer impact assessment from your context, for your team to review and approve.
Marsstein Compliance keeps the anonymization assessment, the chosen mechanism and its supporting documents together with the dataset.
Marsstein does not certify that a dataset is anonymous and does not replace legal advice; your counsel or DPO signs off.
Show the legal basis.
The EU side: anonymous or not.
The GDPR applies to personal data only. Recital 26 excludes anonymous information, meaning data that no longer relates to an identified or identifiable person, taking into account all means reasonably likely to be used to identify someone.
Vehicle camera data is rarely anonymous by default. Blurring faces and plates covers direct identifiers, but the dataset around the frames often carries GPS traces, precise timestamps, lidar point clouds and vehicle identifiers. The Article 29 Working Party (Opinion 05/2014) tests anonymization on three risks: singling out, linkability and inference. Where a dataset does not meet one of them, WP29 calls for a thorough evaluation of the identification risks.
The EDPB guidelines on connected vehicles (01/2020) recommend processing data locally where possible, and considering anonymization before data is transmitted outside the vehicle. Pseudonymized data remains personal data for whoever can re-identify it. In C-413/23 P (4 September 2025) the CJEU held that pseudonymized data may not be personal data for a recipient who cannot reasonably re-identify the people in it.
If the data stays personal: Chapter V.
Transfers of personal data to a third country are governed by Chapter V of the GDPR, Articles 44 to 49. China is not on the European Commission's list of countries with an adequacy decision, so a transfer needs appropriate safeguards under Article 46, in practice the standard contractual clauses of Implementing Decision (EU) 2021/914.
The clauses alone are not the whole job. Under Clause 14 the parties warrant that the laws and practices of the destination country do not prevent compliance, document that assessment, and make it available to the supervisory authority on request.
This is enforced. On 2 May 2025 the Irish Data Protection Commission fined TikTok EUR 530 million, of which EUR 485 million was for infringing Article 46(1) GDPR in transfers of EEA user data to China.
The China side: where the data was collected decides.
For data collected in China, the CAC Several Provisions on Automotive Data Security (in force 1 October 2021) list video and image data from outside the vehicle containing faces and license plates as important data. Important data is to be stored in China, and exporting it requires a security assessment.
For data collected in Europe, the 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows matter. Article 4 exempts personal information collected abroad, transmitted to China for processing and then provided abroad again from the export security assessment, standard contract and certification, as long as no domestic personal information or important data was introduced during processing. Article 3 exempts data from activities such as international trade and multinational manufacturing that contains no personal information or important data.
Anonymizing in the EU before the transfer therefore helps on both sides: it can take the data outside the GDPR and, if the dataset passes the anonymity assessment, keep personal information out of the round trip through China.
Primary sources
Open the documents; this page is a summary, not legal advice.
GDPR Recital 26
Anonymous data is outside the GDPR.
GDPR Chapter V, Articles 44-49
Rules for transfers of personal data to third countries.
Article 29 Working Party, Opinion 05/2014
Singling out, linkability and inference as the tests for anonymization.
EDPB Guidelines 01/2020 on connected vehicles
Local processing; anonymization before data is transmitted outside the vehicle.
CJEU C-413/23 P, EDPS v SRB (4 September 2025)
Pseudonymized data from the recipient's perspective.
European Commission, adequacy decisions
Countries with an EU adequacy decision; China is not among them.
Irish DPC, TikTok decision (2 May 2025)
EUR 485 million for Article 46(1) GDPR transfers to China.
CAC, Several Provisions on Automotive Data Security (2021)
Exterior video with faces and plates listed as important data.
CAC, Provisions on Promoting and Regulating Cross-Border Data Flows (2024)
Articles 3 and 4: exemptions for data export.
Commission Implementing Decision (EU) 2021/914
The standard contractual clauses, including Clause 14 on local laws and practices.