AI fluency for privacy officers: map an intake data flow

Inventory the fields and purpose

A flow map begins with what is collected and why each field is needed.

The fictional form asks for contact email, issue category, free-text description, manager name and favorite AI tool. The stated purpose is to route technical support requests and provide a response. The packet explains the first three fields but gives no reason for manager name or favorite tool.

Ask AI to create a field-purpose table and mark unsupported purposes as unresolved. Do not infer that a field is necessary because it is common in another process. The NIST Privacy Framework describes itself as a voluntary tool for identifying and managing privacy risk; it is background, not a legal rule for this case.

Sources: [3]

Follow each transfer and access role

A collection notice alone does not show where the information travels.

The exercise says submissions enter a support queue and a weekly aggregate reaches the service owner. It does not say whether free text appears in the aggregate or who administers the queue. Show those as questions instead of drawing a complete-looking path.

Keep role access separate from named people. Do not populate the synthetic flow with employee identities. AI may suggest typical processors, but only supplied or confirmed roles belong in the current-state diagram.

Test the free-text field with a minimization prompt

Open text can invite information beyond what routing requires.

The draft label says tell us everything about the issue. Replace it in one option with a task-focused prompt that asks for the error and steps already tried while warning against unnecessary sensitive details. This is an instructional alternative, not a compliance conclusion.

Create a fictional test entry containing a customer name and ask whether the routing purpose needs it. Mark the example clearly synthetic. Do not use real submissions to test the wording without an approved process.

Record retention as an owner decision

A convenient default is not evidence of an approved retention period.

The packet says the queue currently retains records indefinitely because no expiry is configured. It does not establish that this is intended or appropriate. Record current behavior, proposed decision owner and evidence needed for a change.

Do not invent a thirty-day or seven-year period. If an owner chooses a period, preserve the scope, effective date, deletion mechanism and exception questions. AI can organize the decision record but cannot select a lawful period from context it does not have.

Deliver the flow and unresolved-risk register

The handoff should show both known processing and missing decisions.

Include field-purpose table, support-queue transfer, aggregate question, access gaps, free-text alternative and retention issue. Distinguish current behavior from proposals and identify where qualified privacy or legal review is required in real work.

Review data minimization reasoning and uncertainty within the fictional case. The people analytics guide handles already collected aggregates; this resource asks what information should enter an operational flow and how its lifecycle is governed.

Sources and scope

NIST: AI risk management. Skills England: workplace AI foundations.

These references provide background, not validation or endorsement of this exercise. The case details, calculations and suggested review questions are original instructional material. Use them to discuss observable work, not to infer customer outcomes, professional credentials or performance in every setting. Before adapting the exercise, confirm the relevant facts, approved tools, data permissions and decision owners. If you change the case, revisit the expected answers and checks as well. These examples describe practice tasks, not a promise that a particular product includes the fictional features.

Sources: [1] [2]