Impact Assessment Walkthrough for a New Project
Assess privacy risk of a new project.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Walk me through a data protection impact assessment for a project. Project description: [PROJECT]. Data involved: [DATA]. People affected: [PEOPLE]. Technology and vendors: [TECH_VENDORS]. Guide me with these steps, asking questions where needed: describe the processing; assess necessity and proportionality; identify risks to individuals (not just to the organisation) with likelihood and severity in a matrix; propose measures to reduce each risk; record residual risk and who accepts it; and set a review date. Provide a template with those headings and fill the first two sections from my input. Flag where a formal assessment is likely required under rules in [JURISDICTION] and mark that [VERIFY] with a privacy professional. Do not claim legal compliance. Add a short section that explains in plain language why each question matters, a list of the stakeholders to consult (the people affected, the technical team, the privacy lead), and a rule that the assessment is revisited whenever the project's data or purposes change. End with a one-page summary for decision-makers listing the top risks and the measures agreed. Add a worked risk matrix using an invented project (a staff wellbeing survey with free-text answers). List six risks to individuals, such as re-identification from small groups, with likelihood and severity scored from one to three, the resulting rating, one reduction measure for each, and the residual risk. Show how the measures change the ratings. Add a consultation record template covering who was asked, what they said and what changed as a result, and a sign-off block for the risk owner and the privacy lead. Include a list of triggers that require the assessment to be repeated and a note on keeping the document short enough to be read, with a one-page decision summary at the front. Remind me that the legal threshold for a formal assessment is a matter for my privacy professional. Please keep the output protective and non-operational: policies, checks, user training and incident handling, not tools for intrusion.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.