Part 1: What is the GDPR?
The General Data Protection Regulation (GDPR) is the European Union's data protection law. It has applied since 25 May 2018. It protects people's personal data, which is any information that identifies someone or could identify them: a name, an email address, a photo, an identifier, even an online behavior.
It applies to any organization that handles the data of people in the European Union, wherever the organization is based. A few ideas organize the whole text:
- Who does what: the controller decides why and how data is used, and the processor handles it on the controller's behalf.
- Principles: use data lawfully, for a stated purpose, collect no more than needed, keep it accurate, don't keep it forever, and protect it (article 5).
- A legal basis for every use, such as consent, a contract, a legal obligation or legitimate interests (article 6). Sensitive data, such as health, beliefs or biometrics, gets extra protection (article 9).
- Rights for people: to access their data, correct it, erase it, object, take it elsewhere, and not be subject to purely automated decisions (articles 12–22). Organizations generally have one month to answer.
- Duties for organizations: keep records, secure the data, run an impact assessment for risky projects, and report a breach to the supervisory authority within 72 hours when it puts people at risk. In France that authority is the CNIL.
- Consequences: fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches (lesser ones are capped at 10 million euros or 2%).
Applying all this starts with reading a text and asking the right questions: Is there personal data here? Is it sensitive? Is this a request for erasure? Is this a breach? That is slow work, and it is exactly the kind of work a model can speed up.
Part 2: What is Jev, and how is it different from a chatbot?
A normal large language model (LLM, the kind behind chatbots) writes. Given a question, it generates an answer word by word. That is why it can explain, summarize and draft. It is also why it can ramble, invent things, answer in a format you didn't ask for, and give a slightly different answer each time.
Jev, from the company TypeSafe, is built for a different job: deciding. You give it a text and a set of questions with fixed ways to answer. According to TypeSafe, it reads its answers directly from the model's internal scores instead of generating text:
| A chat model | Jev | |
|---|---|---|
| What it does | Writes a free-form answer | Picks among options you define |
| Output | Text you have to read or parse | A probability for each option (yes/no, choose one, or a score on a scale) |
| Can it answer outside your options? | Yes | No: the answer can only be one of yours |
| Can it explain itself? | Yes | No: it gives a verdict and a probability, not a reason |
| Many questions at once | One conversation, one answer at a time | All questions about the same text in one call |
| Speed and cost | Slower and pricier, as it writes every word | Designed to be fast and cheap, because it writes nothing |
Think of the difference between an essay exam and a multiple-choice test with a confidence level next to each answer.
Two honest limits, both stated by TypeSafe. First, "it can't give an invalid answer" is a guarantee about the format, not about being right: a wrong answer is still a perfectly valid one. Second, Jev is weak at arithmetic and dates, takes questions literally, and doesn't keep its answers consistent with one another. It also treats the text as trustworthy, so a text that says "ignore the instructions" can bias it. Those limits shaped how we use it.
Part 3: How we use Jev for the GDPR
The idea is simple: turn the regulation into questions that a text can answer, and let Jev answer them.
- We wrote 148 questions in 16 topics, following the structure of the GDPR: personal data, sensitive data, legal basis, requests, breaches, privacy notices, contracts, transfers and more. Each is a yes/no question about one thing the text says ("Does the text state how long the data is kept?"), tied to an article.
- Jev answers all of them in one go, each with a probability. We display it as "93% sure" and mark anything near 50% as unsure.
- Plain code, not the model, draws the conclusions. Whether an element is missing from a privacy notice, or whether enough criteria add up to require an impact assessment, is counted by ordinary code. That works around Jev's weakness with arithmetic and gives us results we can check.
- The page leads with an overview of what needs attention, and keeps the detail one click away.
- A person decides. Because the text could be misleading and the model can be wrong, the tool is decision support, not legal advice. It helps you see where to look first.
We also added a check that warns you before sending a text containing a card number, a bank account number or a password, so the most harmful data doesn't leave your computer by accident.
The honest summary: Jev is not a lawyer and not a chatbot. It is a very fast, very literal reader that can answer a hundred closed questions about a document in a moment. That is exactly the first pass that data protection work needs.
Sources: GDPR full text (EUR-Lex) · Using Jev with the AI SDK (Vercel)