How to perform a privacy impact review with AI

Define the decision and processing boundary

State what change is being reviewed, the decision required, and which systems, people, data subjects, jurisdictions, and lifecycle stages are in scope. Record whether the review is preliminary, a formal data protection impact assessment, or another internal process. Escalate legal interpretation to accountable privacy counsel.

The UK Information Commissioner’s Office describes a DPIA as an assessment of envisaged processing and says it should address processing operations and purposes, risks to people, safeguards, security measures, and relevant interests in its jurisdiction. NIST’s Privacy Framework provides a voluntary structure for identifying and managing privacy risk. These references guide structure; they do not decide obligations for a particular organization.

Create a processing register:

| Activity | Data | Purpose | Parties | Retention | Source evidence | |---|---|---|---|---|---| | Create assessment invite | Name, work email | Deliver access | Customer admin, service | 30 days after expiry | Workflow and configuration | | Run synthetic exercise | Submitted work, event data | Produce task-bounded evidence | Participant, service | Contracted period | Product flow and data store | | Share report | Assessment report | Human interpretation | Authorized customer users | Contracted period | Access-control record |

This is a synthetic example, not a statement about Two Prune’s current processing or retention.

Draw and validate the data flow

Map collection, transfer, transformation, storage, access, export, correction, deletion, backup, and vendor handling. Mark interfaces and manual steps. For each arrow, name the source system, destination, trigger, fields, transport, owner, and evidence.

Interview technical and process owners separately, then reconcile their accounts with configuration, contracts, event logs, and sample records. An architecture diagram may omit spreadsheets or support exports; an interview may omit automated replication. Keep discrepancies open until evidence resolves them.

A failure example says, “Data stays in the application.” The map later reveals emailed exports and a support queue attachment. Repair the review by adding those flows, parties, access paths, and retention rules rather than treating them as incidental.

Test purpose, necessity, rights, and risk

For each activity, ask whether the stated purpose is specific, whether each data field is necessary, whether another method uses less data, and whether reuse is compatible with the reviewed purpose. Record how people receive information, make requests, correct data, object where applicable, or obtain human review where the process provides it.

Describe risk as a scenario affecting people, with cause, event, consequence, existing measure, evidence, and residual uncertainty. Avoid generic labels such as “low privacy risk.” Test unauthorized access, unexpected reuse, excessive retention, inaccurate inference, exclusion, and inability to exercise rights.

AI may produce a threat list, but reviewers must connect each item to the actual flow. Remove scenarios that do not fit and add domain-specific ones the model missed.

Verify measures and residual decisions

Do not equate a written policy with an operating measure. Inspect configuration, access reviews, deletion jobs, contractual terms, incident procedures, and sample evidence. Name the owner and review frequency for each measure.

Before approval, confirm:

The artifact is the privacy review plus processing register, flow map, discrepancy log, risk table, measure evidence, owner approvals, and review date.

• the processing boundary and decision are explicit;
• every data flow has a validated source and destination;
• purposes, fields, parties, and retention are specific;
• manual exports and exception paths are included;
• rights and information paths are operationally described;
• risks concern effects on people, not only the organization;
• measures have operating evidence and owners;
• unresolved legal or technical questions are escalated; and
• the final decision records conditions and residual uncertainty.

Sources and claim map

The people, flows, systems, and retention periods are synthetic. This educational method does not establish a legal basis, regulatory duty, rights outcome, or privacy conformity.

• Information Commissioner’s Office, Data protection impact assessments: supports the limited description of DPIA content and risk considerations in its scope.
• NIST, Privacy Framework: supports voluntary, risk-based privacy identification and management structure.

Sources: [1] [2]