AI does not remove existing data-protection responsibilities. It can make them harder to see because personal information travels through workflow platforms, model providers, logs and connected applications. A project should map that movement before production use. This checklist is operational guidance, not legal advice.
Define purpose and lawful basis
State why personal data is required and which lawful basis supports the processing. A vague objective such as "use AI to improve the business" is not enough. Different purposes may require different assessments and notices.
Minimise the data
Send only fields required for the task. Remove identifiers when they do not affect the output. Avoid placing entire customer records into prompts when a category, short extract or pseudonymous reference would work.
Map suppliers and locations
List every processor, subprocessor and storage location. Review data-processing terms, retention, deletion and international transfer arrangements. Confirm whether submitted data is used to train models and which account settings control that behaviour.
Control access and retention
Use separate service credentials with minimum permissions. Protect workflow logs because they may contain input and model output. Set retention periods for prompts, conversations and extracted documents instead of retaining them indefinitely by default.
Protect individual rights
Know how to locate, correct and delete information across the workflow. Provide a human route for decisions that significantly affect people. Record enough context to explain how an output was produced and which data supported it.
Assess risk before expansion
Consider a data protection impact assessment where processing is likely to create high risk. Test for inaccurate extraction, inappropriate disclosure and biased classification. Reassess when the purpose, model or data source changes.
The practical design principle is simple: give the automation the least data and authority it needs, then make its activity visible to accountable people.