Privacy-by-design for AI features
The seven questions to answer before a single user record touches a model.
Privacy work fails when it arrives as a review at the end. Answer these while the spec is still editable, and legal review becomes a confirmation rather than a redesign.
The questions: what personal data enters the prompt; what lawful basis covers it; does the provider train on it; where is it processed; how long is it retained by you and by them; can a user get it deleted end to end, including from logs and eval sets; and what does the user actually see about all of this.
Most of the answers are architectural. Redact before the call rather than after. Keep a field-level allowlist instead of a blocklist. And remember that your eval sets and traces are copies of production data with their own retention story.
Want this applied to your situation?
Sessions are direct and specific — you leave with a decision, not a reading list.
Book a session