The first data protection question about AI is which systems process personal data and on what basis. This records it as each use case is approved rather than reconstructing it later.
What's Included
- Personal data recorded per use case including categories and subjects.
- The basis and the assessment captured at approval time.
- Retention and deletion stated rather than assumed.
- An assistant that flags a use case needing a fuller assessment.
How To Use
- Record it at approval. Reconstructing it later is far harder and less accurate.
- Name the data categories specifically rather than writing customer data.
- State retention explicitly. Indefinite is a decision, not a default.
- Involve your privacy adviser on anything sensitive. This records, it does not advise.
Capture it during risk assessment, and cross-check with the vendor assessment.