## 3 Methodology
### Evaluation Criteria
#### 3.5.1 Benchmarks  
For the initial model evaluation, we designed benchmarks specifically for GDPR documentation generation. The multiple-choice benchmark evaluated the knowledge of GDPR requirements, asking models to select appropriate data categories for specific processing activities. The generation benchmark evaluated the quality and stability of responses as the model generated data categories under different prompts, ensuring adaptability and accuracy under different formulations. **Multiple-choice benchmark**. To evaluate GDPR contextual knowledge, we developed a benchmark consisting of 25 multiple-choice questions. Each question required selecting the data categories that best corresponded to a specific processing activity from eight options, testing the model's ability to recognize GDPR-specific data categories. For example:  
Which data categories are appropriate in the context of GDPR for the processing activity entitled \"time tracking \" with the description \"recording the working hours of individual employees to fulfill the duty of proof\"? . Date and time of the query  
. Working hours  
. Communication data  
. Sick days  
. Vacation days  
. Name  
. Phone number  
. Age  
The benchmark was evaluated with a maximum of 5 points per model based on the following metrics:  
1. Diversity (1 point). Diversity assesses whether the model provides diverse, contextually appropriate answers to the questions. A lack of diversity could indicate a failure to understand the nuances of different GDPR categories and processing activities. Accordingly, if a model lacked diversity in its responses, it scored 0 points for the entire benchmark. Otherwise, it was awarded 1 point. 2. Accuracy (0-2 points). Accuracy [39] measures the correctness of answers, which is essential in GDPR documentation, as accurate data categorization ensures that organizations comply with legal obligations regarding specific data types. Two points were awarded for an accuracy of \(>\)75% and one point for an accuracy of \(>\)60%. 3. F1 Score (0-2 points). The F1 score [39] emphasizes the balance between precision and recall, which is critical in GDPR tasks to ensure that models reliably identify all relevant categories without including irrelevant ones. Again, 2 points were awarded for an F1 score of \(>\)75%, and 1 point was awarded for an F1 score of \(>\)60%. **Generation benchmark**. The generation benchmark consisted of a series of tasks in which models inferred 25 exemplary processing activities using five different prompts. Scoring involved comparing the generated responses with the correct data categories. As the models were asked to generate data for ten categories in the experiments, only processing activities associated with ten or more corresponding data categories were included in this benchmark. The difficulty of achieving a full score varied, as some questions were associated with only ten categories, while the maximum number of associated categories was 36, making it easier to achieve higher scores. Models could achieve a maximum score of 100% on this benchmark if all generated categories matched those in the dataset. Notably, the model was consistently prompted with five standardized prompts, with the processing activity changing every five iterations. The prompts are listed in Figure 6. This benchmark measured the ability of a model to consistently generate accurate data categories for arecord of a processing activity, ensuring that it could handle legal language and structured requirements in different scenarios. Final scores were assigned based on the percentage of correct answers: Models scoring above 50% received 5 points, those scoring 45-50% received 4 points, 40-45% 3 points, 35-40% 2 points, 30-35% 1 point, and scores below 30% received 0 points. Building on the benchmarks, the next step involved a detailed evaluation of the generated answers to ensure their alignment with GDPR requirements.