Check my AI workflow for privacy and data-protection risks
Maps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
The prompt
Review an AI-assisted workflow for privacy and compliance risks before we roll it out.
The workflow, step by step: [WHAT HAPPENS, which AI tool is used at each step, and who is involved]
Data that flows through it: [e.g. "customer names and emails, call recordings, order history"]
Where the data goes: [tools, vendors, regions, integrations]
Who it affects: [employees / customers / patients / job applicants / the public]
Our industry and locations: [e.g. "US healthcare", "EU retail"]
Rules or policies I know apply: [e.g. GDPR, HIPAA, CCPA, EU AI Act, sector rules, internal AI policy - or "not sure"]
Work through:
1. Data map - what personal or confidential data enters each step, and whether it is needed at all (data minimization).
2. Privacy risks - lawful basis or consent, notice to the people affected, retention, sharing with vendors, cross-border transfer, re-identification, and use of inputs to train models.
3. Compliance risks - automated decisions about people, record-keeping duties, sector rules, contract terms with clients, and claims we make about AI to customers.
4. Risk table: Step | Risk | Likelihood (H/M/L) | Impact (H/M/L) | Control to add | Owner.
5. Must-fix before launch versus fix soon.
6. Questions to take to our privacy, legal, or compliance team.
Name a regulation only when it plausibly applies, and mark anything uncertain as [CONFIRM WITH LEGAL]. Do not state that the workflow is compliant - this is a first-pass review to prepare for expert sign-off, not legal advice.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- tools, vendors, regions, integrations
- e.g. "US healthcare", "EU retail"
- CONFIRM WITH LEGAL
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.
- Assess a possible HIPAA breach and decide on notificationsWalks through the four-factor breach risk assessment, documents the decision, and drafts the notifications required if it is a reportable breach.