AI Tools and Privacy Risk Review
Assess data exposure when staff use AI tools.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Help me assess the privacy risk of staff using AI tools. Interview me one question at a time and wait: (1) which AI tools staff use, approved or not; (2) what kinds of information are typed or uploaded (customer data, contracts, code, health, financial, employee); (3) whether accounts are personal or company-managed; (4) what each provider's terms say about training on our data and retention (I will paste them, or tell me what to look up); (5) whether we have an AI policy; (6) which regulations or contracts apply to us; (7) any incidents so far. Starting notes: [CURRENT_AI_USE]. After the interview, produce: 1. A data-flow table: Tool | Data types entered | Where processed | Retention | Training use | Risk level (low, medium, high) | Reason. 2. A classification of data into never allowed, allowed with approval, and allowed. 3. A one-page acceptable-use policy of ten numbered rules. 4. A checklist of settings and contract points to check with each vendor [VERIFY]. 5. An incident response list of six steps for when sensitive data is pasted by mistake. 6. A staff training outline with three realistic examples. Do not assume vendor terms; say what needs checking. Treat all output as a draft for discussion, not legal advice. Have a qualified lawyer or privacy specialist who knows [JURISDICTION] verify it before you rely on it.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Claude, Gemini, ChatGPT or another assistant.