Privacy leadership for AI-enabled knowledge work

Define the decision and the privacy role

Begin with one proposed workflow, such as summarizing internal support tickets to improve training materials. Name the business owner, intended output, users, data sources, tool and vendor, affected people, jurisdictions, decision date, and consequence if the use is wrong. Record whether the privacy leader owns, reviews, advises, or collaborates on each issue.

Map the full data journey from collection to deletion. Include copied text, attachments, retrieval indexes, prompts, outputs, logs, exports, human notes, and downstream documents. Identify direct identifiers, sensitive context, free text, inferred attributes, and combinations that may make a person recognizable even when names are removed.

The NIST Privacy Framework is a voluntary tool for managing privacy risk to individuals through enterprise risk management. Its profile approach supports recording current and target outcomes, data-processing roles, and priorities. It is technology- and jurisdiction-neutral and does not decide what a particular organization must do under applicable law.

Sources: [1]

Build the privacy decision docket

Create sections for purpose, necessity, minimum data, affected groups, expected benefit, potential problems for individuals, alternatives, access, retention, vendor role, human review, technical controls, worker instructions, monitoring, incident response, evidence, owner, conditions, and review triggers. Link each conclusion to the evidence that supports it.

Separate facts from assumptions. A contract may describe storage location, while actual configuration evidence shows which feature is enabled. A vendor statement may describe a product generally, while the organization's plan, permissions, integrations, and settings determine the deployed behavior. Record missing evidence rather than converting it into approval.

The UK Information Commissioner's Office provides guidance on AI and data protection for organizations processing personal data. It distinguishes legal requirements from good-practice recommendations and addresses accountability, purpose, minimization, accuracy, security, and rights. It is not an exhaustive guide to every legal obligation.

Sources: [2]

Worked artifact: a synthetic support-ticket proposal

Imagine a synthetic enablement team proposing to summarize support tickets with an assistant. The privacy decision docket shows that tickets include names, account identifiers, free-text health details, employee comments, and pasted logs. The proposed output is a set of common training themes, so direct identifiers and most account detail are unnecessary.

The privacy leader asks the business owner to compare three options: manual sampling, a locally configured analysis using reduced fields, and the proposed external service. The chosen pilot uses synthetic tickets first, then an approved reduced dataset with sensitive lines excluded, restricted access, a short retention period, and a human review for overly specific themes.

During testing, a rare product description makes one customer recognizable to a reviewer. The owner stops publication, raises the minimum aggregation level, removes verbatim examples, and records the failed test and correction. The docket approves only the revised limited pilot, with a new review after any tool, purpose, field, or audience change. This example is synthetic and does not demonstrate legal compliance or Two Prune customer outcomes.

Verify the decision in operation

Confirm that deployed settings, permissions, transformations, logs, retention, and deletion match the docket. Sample ordinary and edge cases, inspect exceptions, and verify that workers know when to stop and escalate. Reopen the decision when evidence, purpose, population, vendor, model, integration, jurisdiction, or consequence changes.

Two Prune can provide task-bounded evidence about how a participant identifies privacy cues, uses sources, checks an output, and escalates in a controlled simulation. It does not act as a data protection officer, determine legal obligations, approve customer processing, or make employment decisions.