## 3 Methodology
### Evaluation Criteria
#### 3.5.2 Answer Evaluation  
To further ensure that the output met GDPR requirements, each generated answer was scored on five criteria relevant to regulatory compliance tasks. Each answer could receive between 0 and 5 points for each criterion. The scoring is detailed below and summarized in Table 2.  
* Latency. Efficient document drafting is valuable for GDPR compliance, as responsiveness affects the feasibility of the solution in real-world applications. Points were awarded as follows: 5 points for latency under 5 s, 4 points for under 7.5 s, 3 points for under 10 s, 2 points for under 12.2 s, 1 point for under 15 s, and 0 points for 15 or more seconds.
* Structure and style. GDPR documentation often follows a strict formatting to ensure clarity and consistency across records. This criterion checked whether the model output a structured list with exactly ten bullet points in clear, straightforward language with no repetitions of words. Proper formatting helps avoid ambiguity and supports auditors in verifying compliance. Each fulfilled aspect earned 1 point, with a total possible score of 5 points.
* Grammar. Grammatical accuracy is critical in the legal domain to prevent misinterpretation of legal documentation. Correct grammar contributes to the credibility and readability of the document, ensuring that records are unambiguous and meet professional standards in legal documentation. Points were awarded based on the number of grammatical errors: 5 points for no errors, 4 points for 1 error, 3 points for 2 errors, 2 points for 3 errors, 1 point for 4 errors, and 0 points for more than 4 errors. Answers written in another language than English automatically scored 0 points.  
Figure 6: Prompt variations in the generation benchmark. Each prompt was applied to five processing activities.  
* Validity. This criterion assessed the relevance of each generated category according to GDPR requirements. Categories that are not related to GDPR, such as analytics or marketing data, must be excluded to ensure that the outputs are in line with legal guidelines. A high validity score means that the data categories are relevant and legally appropriate, which is critical to maintaining regulatory compliance. Scores were awarded as follows: 5 points for 100% valid categories, 4 points for 90%, 3 points for 80%, 2 points for 70%, 1 point for 60%, and 0 points for less than 60%.
* Contextual understanding. In GDPR documentation, understanding the context of data processing activities is essential. This criterion evaluated whether the model captured the full range of relevant categories for a given activity (e.g., covering customer contact data, order information, and communication data for an e-commerce scenario). Comprehensive contextual understanding ensures that documentation accurately represents all necessary facets of data processing for legal compliance. One point was awarded for an answer free of redundancy, ensuring that categories were not duplicated. Another point was awarded for including specific data fields within categories (e.g., \"Customer Data (Name, Address, Contact Information)\"). The final three points were awarded based on context coverage. Therefore, the context for our example _operation of a webshop_ was divided into six parts, with each part earning 0.5 points if included.  
1. Customer contact (phone number, address, email)
2. Order (customer number, order number, products, price)
3. Payment (credit card info, payment data)
4. User profile (IP address, password, username)
5. Communication data (support requests, ratings)
6. Personal data (gender, name, age, date of birth)