GDPR Browser Compliance · For EU organizations

Every AI prompt with personal data is a processing activity.

And usually a transfer. AI tools make it easy for customer records, case files and HR data to leave through a prompt. MBCTG Managed Browser Security gives your DPO the record GDPR requires, and stops what should never leave.

Talk to an expert How the service works →

dpo_record · art_30_32 Illustrative record

Data categories that left the browser ● Per event

Receiving processor ● Named

Originating department ● Logged

What was stopped or redacted ● Documented

User attribution ● Pseudonymous by default

Articles 30 & 32

What your DPO must produce. What the service records.

Article 30 requires a record of processing activities; Article 32 requires appropriate technical measures. When personal data flows to AI tools through the browser, there is often no record of what left, to which processor, or what was done about it.

The service records exactly that: which categories of personal data left the browser, to which processor, from which department, and what was stopped. Enforcement is a technical measure your DPO can point to, not a policy PDF.

Enforced in the browser

Policy that acts, not policy that gets signed.

AI prompts inspected on-device

Prompts to ChatGPT, Claude and Gemini inspected before submission, with sensitive fields redacted automatically. Inspection happens on the device. Only policy events and metadata leave the endpoint.

Uploads controlled by data type

Content-inspected upload and download control across Chrome and Edge, by site and data type: personal data to personal storage is blocked, not discovered later.

Tenant control

Users are confined to company tenants across Microsoft 365, Google, Slack, GitHub and AI tools, so the shadow-IT transfer path is closed by policy.

Privacy by design

Built to satisfy the DPO, not alarm the works council.

Deterministic detection

Rule-based classification, not an LLM reading your users’ data. What is inspected and why is explainable and auditable.

Pseudonymous by default

Reports are pseudonymous; named attribution is the customer’s choice, not the default.

Your data sovereignty

Your Sentinel workspace stays in your tenant or in MBCTG’s dedicated MSSP workspace. Your choice. MBCTG operates under a signed data processing agreement.

No classification project first

No sensitivity labels, no Purview onboarding, no data classification program required before enforcement starts.

Part of a wider EU compliance practice.

The service pairs with MBCTG’s GDPR, NIS2 and Cyber Resilience Act consulting. The browser evidence feeds the same compliance program.

GDPR NIS2 EU CRA

Read the EU CRA briefing →

Show your DPO what actually leaves the browser.

Start with a pilot: 20–50 users in warn-and-redact mode, first records within days. Enforcement tuned per department, exceptions documented.

Ask for a pilot scope Explore Managed Browser Security →