AI privacy review records

Document the purpose, data access, and safeguards of an AI workflow so privacy and governance teams can review it.

View AI governance

Information to prepare

  • Purpose. The task, intended users, and reason for using the data.
  • Data flow. The fields, sources, tools, services, and outputs involved.
  • Safeguards. Access limits, approvals, retention rules, and exception handling.
  • Responsibilities. Who maintains the records and reviews changes or incidents.

Records for a DPIA

A Data Protection Impact Assessment (DPIA) uses information about the planned processing and its safeguards. Workflow documentation and event records provide technical information for that review.

Prepare the records with the people responsible for privacy review, covering the workflow's purpose, data flows, and safeguards.

Related work

See our guidance on data governance and audit trails. TN-Proto explores ways to associate identity, permissions, and policy information with transaction events.