AI Tools and Privacy Risk Review
Assess data exposure when staff use AI tools.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Help me assess the privacy risk of staff using AI tools. Interview me one question at a time and wait: (1) which AI tools staff use (approved or not), (2) what kinds of information are typed or uploaded (customer data, contracts, code, health, financial, employee), (3) whether accounts are personal or company-managed, (4) what the tool providers' terms say about training on our data and retention (I will paste or you will tell me what to look up), (5) whether we have an AI policy, (6) which regulations or contracts apply to us, and (7) any incidents so far. Starting notes: [CURRENT_AI_USE]. After the interview, produce: a data flow table (Tool | Data types entered | Where processed | Retention | Training use | Risk level); a classification of data into never allowed, allowed with approval, and allowed; a draft one-page acceptable use policy with ten rules; a list of settings and contract points to check with each vendor [VERIFY]; an incident response step list if sensitive data is pasted by mistake; and a short training outline for staff with three realistic examples. Do not assume vendor terms; say what needs checking. Treat all output as a draft for discussion, not legal advice. Have a qualified lawyer or privacy specialist who knows [JURISDICTION] verify it before you rely on it.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Claude, Gemini, ChatGPT or another assistant.