TrustWorks MCP Use Cases
This guide walks through practical ways to use the TrustWorks MCP connector with Claude or another connected AI assistant. Each use case explains how it works, what to have ready, and gives a prompt you can copy and adapt.
The examples use Claude. Use cases 1 and 2 work the same way in ChatGPT or Microsoft Copilot when they are connected to TrustWorks. Use case 3 uses Claude in Chrome, so it is Claude only.
Before you start: Connect the TrustWorks MCP connector by following the TrustWorks MCP + Claude Setup Guide. Claude can only see and change the records your TrustWorks user has access to.
Contents
1. Run a gap evaluation on your records
2. Create an assessment template with the MCP
3. Fill in assessments with Claude in Chrome
1. Run a gap evaluation on your records
Claude can read your TrustWorks records through the MCP connector and check them for missing, incomplete or inconsistent information. A gap evaluation only uses read-only tools, so nothing in TrustWorks changes unless you ask Claude to make an update.
This is a quick way to prepare for an audit, check your RoPA before a DPO review, or find where to focus your team's time.
What Claude can check
Some examples of the checks you can ask for:
| Area | Example checks |
|---|---|
| Processing activities | Missing description, purpose, lawful basis, retention schedule, data mapping, controller or processor role, or owner. Processing involving special category data, so you can confirm the additional conditions are recorded. |
| Assets | Assets with no owner, classification or provider, or not linked to any processing activity. |
| Vendors and legal entities | Processors linked to processing activities with no contacts or sub-processors recorded. |
| Risks | Risks with no owner or mitigation measure, and high risks that are still open. |
| Assessments | Records with no completed assessment, such as high-risk processing with no DPIA, and assessments still in progress. |
| Data map consistency | Duplicate or near-duplicate data categories, and categories that are not used anywhere. |
Check against a regulation
You can also ask Claude to check your records against a specific requirement, for example the record of processing requirements in GDPR Article 30, UK GDPR or LGPD. Claude compares the information held in TrustWorks with what the regulation expects and lists what is missing. Treat the result as a starting point for your own review, not as legal advice.
How it works
Step 1: Choose the scope
Decide which records to check, for example all processing activities, one business function, or one legal entity. Narrowing the scope gives faster, more focused results, especially in larger tenants.
Step 2: Choose the checks
Pick the checks from the examples above, or name the regulation to check against.
Step 3: Run the prompt
Paste the prompt below. Claude reads the records and returns its findings, grouped by record, with the gaps for each one. You can ask for the results as a table or a spreadsheet to share with your team.
Step 4: Review and fix
Review the findings and prioritise them. You can update the records yourself in TrustWorks, or ask Claude to make specific updates through the write tools. If your tool permissions are set to Needs approval, you approve each update as it comes up.
Prompt to copy
Replace the parts in square brackets:
Using the TrustWorks MCP connector, run a gap evaluation on [all processing activities / the processing activities in the [business function] business function / all assets].
Check for: [missing lawful basis, retention schedule, data mapping and owner / the GDPR Article 30 requirements].
- Only read records. Do not create or update anything.
- List the gaps for each record, and group records with the same gaps together.
- Flag anything that looks inconsistent, such as a lawful basis that doesn't fit the purpose.
- Finish with a short summary of the most common gaps and which records to prioritise.
2. Create an assessment template with the MCP
You can work with Claude, or your AI assistant of choice if it is connected to TrustWorks, to build a new assessment template without using the assessment editor. There are two ways to start:
- Build the questions in the chat. Describe the assessment you need, and draft and refine the questions with Claude in the conversation.
- Start from your existing document. Upload the Word or Excel assessment you already use. Claude reads it and maps each question to a TrustWorks question type.
Either way, Claude shows you the proposed structure in the chat first, so you can review and adjust it before anything is created in TrustWorks.
How it works
Step 1: Decide what the assessment runs on
Assessments in TrustWorks run on an asset, a processing activity or an initiative. This choice decides which smart questions and custom fields are available, so tell Claude up front.
Step 2: Share your questions or document
Paste or describe your questions, or upload your Word or Excel file.
Step 3: Review the proposed build in the chat
Claude lays out each section and question with its proposed question type, answer options, skip logic and risk rules. Ask for any changes before moving on, for example merging questions, changing answer options or adding guidance text.
Step 4: Create the template in TrustWorks
Once you are happy, ask Claude to create the template. It is created unpublished, so you can check it before anyone uses it.
Step 5: Check and test in TrustWorks
Open the template in the assessment editor and check the flow and question settings. Then publish the template, publish a test workflow that sends the assessment to yourself, and complete it to check everything works as expected before rolling it out.
Question types
When Claude maps your questions, it uses the question types available in TrustWorks:
| Question type | What it is for |
|---|---|
| Multiple Choice | A fixed list of answers, with a single answer or several answers allowed. You can add an additional details box for free-text context. This is the only type that supports skip logic and conditional risks. |
| Short Question | A free-text answer, for descriptions and explanations. |
| Statement | Information or instructions shown to the respondent, with no answer required. |
| File Upload | Lets the respondent attach supporting evidence, such as a policy or contract. |
| Smart questions | Linked to the record the assessment runs on. They show the information already held on that record and update it when answered (see below). |
| Custom field questions | Linked to one of your custom fields. The answer is saved to the record as well as the assessment (see below). |
Smart questions
Smart questions connect the assessment to your inventory, so respondents confirm or update what is already recorded instead of retyping it. The smart questions available depend on what the assessment runs on:
| Assessment runs on | Smart questions available |
|---|---|
| Processing activity | Description, purpose of processing, data mapping, lawful basis, controller or processor role, and retention schedule. |
| Asset | Description, categories of data, related processing activities, provider, related legal entity, classification, and AI use cases. |
| Initiative | Description, reference documents, assets and processing activities, data mapping, and AI use cases. |
In the assessment editor, smart questions appear in the question list by name, for example Initiative Description, Reference Documents and Asset and Processing Activity on an initiative assessment. The standard question types are the same whatever the assessment runs on.
Custom fields
Custom fields are your own fields on assets, processing activities and initiatives. When a custom field is used as a question, the answer is saved to the record and shown under Additional information. A later assessment that uses the same custom field is prefilled with that answer, as long as it runs on the same record.
For example, if an assessment on a processing activity has already answered a custom field, a new assessment on that same processing activity is prefilled with the answer. An assessment on a different processing activity is not prefilled, unless that custom field has already been filled in for it, either through another assessment or directly on the processing activity.
Claude can also create custom fields for you, for example when your document asks for information that TrustWorks does not hold as standard. Good to know:
- Custom field names are visible on the record outside the assessment, so use clear, readable names. Commas are not allowed in field names.
- Custom field questions cannot have skip logic or conditional risks. Use a Multiple Choice question for those.
- Custom fields appear on every record of that type (every asset, processing activity or initiative), even when left empty, so only create the ones you need.
Skip logic, risks and reviewer sections
- Skip logic can only be set on single-answer Multiple Choice questions, and can only jump forward to a later question or section.
- Conditional risks raise a risk automatically when the respondent picks specific answers.
- Reviewer sections are only visible to reviewers, for example a DPO review and sign-off section.
Prompt to copy
Fill in the parts in square brackets and attach your document if you have one:
Using the TrustWorks MCP connector, help me build a new assessment template in TrustWorks.
Template name: [name]
The assessment will run on: [processing activities / assets / initiatives]
Source: [the attached document / the questions below]
Assessment type and framework: [e.g. DPIA, UK GDPR]
1. Map each question to a TrustWorks question type (Multiple Choice, Short Question, Statement, File Upload, smart question or custom field question). Suggest skip logic and risk rules where they make sense.
2. Show me the proposed structure in the chat, section by section, before building anything. Flag any questions that don't map cleanly.
3. List any new custom fields you need and wait for my approval before creating them.
4. Once I approve, create the template in TrustWorks and leave it unpublished.
Update an existing template
You can also ask Claude to change an existing template without opening the assessment editor, for example to reword questions, change answer options, add guidance text, or add skip logic and conditional risks.
- Tell Claude the exact template name, and ask it to show you the proposed changes before applying them.
- For larger changes, ask Claude to copy the template first and make the changes on the copy, so you can test them before updating the original.
- Changing a question's type replaces it with a new question, so check the question's settings afterwards.
- After the update, ask Claude to confirm that the rest of the template, including descriptions, skip logic and risks, is unchanged.
- Changes only apply to assessments sent through a new workflow. Assessments already sent keep the version they were sent with. To use the updated template, publish a new workflow.
3. Fill in assessments with Claude in Chrome
The TrustWorks MCP connector cannot enter answers into an assessment directly. Instead, you can use Claude in Chrome from the Claude desktop app: Claude reads your documents, works out which answer belongs in which question, and fills in the assessment in your browser. You then review it and submit it yourself.
What you need
- The Claude desktop app. This use case uses the desktop app, not Claude on the web.
- A paid Claude plan. Claude in Chrome is available on Pro, Max, Team and Enterprise plans. On Team and Enterprise plans, your admin may need to enable it.
- Google Chrome with the Claude in Chrome extension installed and signed in with the same Claude account.
- Access to the assessment in TrustWorks, and be signed in to TrustWorks in Chrome.
Note: browser tasks use more of your Claude usage limits than a normal chat, so filling a long assessment may use a significant amount.
How it works
Step 1: Connect the TrustWorks MCP
Follow the TrustWorks MCP + Claude Setup Guide if you have not connected it yet.
Step 2: Turn on Claude in Chrome in the desktop app
Make sure the Claude in Chrome connector is enabled in the desktop app, and that both it and the TrustWorks connector are turned on for the conversation you use.
Step 3: Set up the assessment
Make sure the record you want to assess (the processing activity, asset or initiative) already exists in TrustWorks. Claude could create the assessment workflow for you, but it is best to have it set up already, so you control the respondents and reviewers.
Note: make sure you are set as the respondent. If the assessment is sent to someone else, you may not be able to respond, and Claude will not be able to fill it in.
Step 4: Have your documents ready
Gather the document or documents that hold the answers, for example a supplier's questionnaire, a project brief or a previous DPIA, and attach them to the chat.
Step 5: Paste the prompt and let it run
Paste the prompt below, fill in the details, and let Claude work through the assessment. Keep Chrome open while it runs. When it finishes, review the flagged items, complete any blank answers, and submit the assessment yourself.
Prompt to copy
Replace the parts in square brackets:
In TrustWorks, use the attached document(s) to run the [assessment template name] assessment on the [processing activity / asset / initiative] "[record name]" with Claude in Chrome. The workflow already exists.
Before filling anything, extract the information from the document(s) and decide which question in the assessment each piece belongs in.
- Only complete answers that are clear from the document(s). Do not invent anything; if you don't know the answer, leave it blank.
- Flag any prefilled responses and any discrepancies between them and the document(s). Don't override them.
- Flag risks and suggest mitigation strategies, but don't assign tasks.
- Do not submit the assessment. I will review it manually before submitting.
When you're done, give me a summary of what has been completed and what is still required.
Important: you remain responsible for the answers in the assessment. Always review what Claude has entered, and the summary it gives you, before you submit.
Troubleshooting
| Issue | What to check |
|---|---|
| Claude cannot connect to Chrome | Restart or update the Claude in Chrome extension. If the Claude in Chrome toggle is not active in the desktop app's connector settings, restart or update the Claude desktop app. |
| Claude cannot open or see the TrustWorks page | Refresh the page and check the extension is enabled. Make sure you have granted the extension permission to use the TrustWorks site. |
| The extension does not recognise your account | Check the extension is signed in with the same Claude account as the desktop app, in the Chrome profile you are using. |
| Claude uses the wrong browser | If Chrome is connected on more than one computer or profile, ask Claude to list the connected browsers and tell it which one to use. |
| Claude in Chrome is not available | On Team and Enterprise plans, your admin may need to enable Claude in Chrome for your organisation. |
| TrustWorks signs you out during the run | Sign back in to TrustWorks in Chrome, check what has already been entered, and ask Claude to continue from the next unanswered question. |
4. Ideas for other use cases
- Clean up your data map. Find duplicate or near-duplicate data categories across processing activities, agree the terms to keep, and consolidate them.
- Import records from a spreadsheet. Create processing activities, assets, vendors or legal entities in bulk from an existing RoPA, asset register or vendor list.
- Build out a risk register. Create risks in bulk from an existing risk register or assessment findings, with suggested mitigation measures.
- Align custom fields to your requirements. Create or update custom fields to match an internal list of mandatory fields, such as a RoPA field specification.
- Report on your programme. Summarise open risks, assessment status and outstanding tasks for a DPO, management or board update.
- Review AI use cases. Check AI use cases found by the AI adoption scanner and decide which to bring into your AI inventory.
- Translate an assessment template. Copy an existing template and translate it into English, Spanish or Brazilian Portuguese.
5. Limitations
All use cases
- Claude can only see and change the records your TrustWorks user has access to.
- Delete actions are not supported through the TrustWorks MCP connector.
- AI can make mistakes. Always review Claude's output, and any changes it proposes, before relying on them.
Gap evaluations
- Findings are based only on the information held in TrustWorks at the time of the review.
- In larger tenants, you may need to narrow the scope to get complete results.
- A check against a regulation is a starting point for your own review, not legal advice.
Assessment templates
- Claude cannot preview the template as respondents see it, and the section flow can occasionally need adjusting after a build. Always check the flow and question settings in the assessment editor before using it in a workflow.
- When Claude copies a template, some settings can be lost, such as reviewer-only sections. Check all settings on the copy in the assessment editor.
Filling assessments with Claude in Chrome
- Assessment answers cannot be entered through the MCP connector itself, only through Claude in Chrome.
- This use case needs the Claude desktop app and a paid Claude plan.
- Claude works through the page like a person would, so long assessments take time, and browser tasks use more of your usage limits than a normal chat.
- Claude can only fill in what your documents cover. Anything missing or unclear is left blank for you to complete.