Review GDPR obligations for the actual personal-data processing activity, not the model label. An AI application can create additional copies of data in prompts, retrieval stores, telemetry, and exports, so those paths belong in the assessment.
Prepare the data-processing inventory
- Describe the purpose of each AI workflow and the people whose data it uses.
- Identify recipients, service roles, storage locations, and retention decisions.
- Record what evidence the application retains and why it is necessary.
- Ask the responsible privacy reviewer to determine the applicable basis, notices, rights, and assessment requirements.
Engineering checks
Test that retrieval and tools enforce the authenticated user’s access. Use synthetic records to check minimization and deletion across logs, exports, caches, and embeddings. Record where a deletion cannot be completed automatically so the responsible reviewer can resolve it.
Automated decisions need a specific assessment
Document whether the system advises a person, makes a decision, or triggers an action, and what effects that has. Do not treat a generic human-review button or a monitoring report as a determination that a legal condition has been met.
Source and scope
The linked EUR-Lex regulation is the authoritative reference. This page is an engineering preparation checklist; it does not summarize every article or determine obligations for a particular deployment.
References and further reading
Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.