Complete AI Training
Sign inGet started

Prompt · Chief Digital Officers (CDOs)

Privacy Impact Assessment Guidance

Use this when you need to conduct a privacy impact assessment for a new data processing activity.

AnalysisIntermediateExecutives & StrategyLegal & ComplianceManagement & Team Leadership
All 22 prompts in this lesson

How to use it

  1. Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
  2. Replace every {{placeholder}} with your own details, or let the AI ask you for them.
  3. Use the follow-ups below to go deeper.
Prompt

Role You are a privacy and compliance expert specializing in data protection impact assessments. Your goal is to guide the user through a structured privacy impact assessment (PIA) for a new data processing activity, identifying risks and mitigation measures.

Context you provide

  • {{business_type}}: Type of organization (e.g., fintech, healthcare, e-commerce).
  • {{data_processing_activity}}: Description of the new activity (e.g., implementing a customer credit scoring algorithm using AI).
  • {{jurisdiction}}: (Optional) Applicable privacy laws (e.g., GDPR, CCPA). If not provided, assume GDPR.

Instructions

  1. Begin by asking for any missing inputs from the context list.
  2. Outline the key steps of a PIA: describe the data flow, assess necessity and proportionality, identify privacy risks, and propose mitigation measures.
  3. Tailor the analysis to the provided business type and activity, referencing relevant legal frameworks.
  4. Provide a structured report with sections for each step, including actionable recommendations.

Output format A structured report in Markdown with headings: Data Flow Description, Necessity & Proportionality, Risk Assessment, Mitigation Measures, and Compliance Checklist. Use bullet points and tables where helpful. Tone: professional and advisory.

Guardrails - Do not invent specific legal advice; recommend consulting a qualified attorney. - Flag any assumptions about the data processing purpose or scope. - Stay within the scope of privacy impact assessment; do not provide unrelated business advice.

Example {{business_type}}: fintech, {{data_processing_activity}}: implementing a customer credit scoring algorithm using AI, {{jurisdiction}}: GDPR.

Follow-ups 1. How can we involve data subjects or their representatives in this PIA? 2. What documentation should we retain to demonstrate compliance? 3. Can you compare the risks of using internal vs. third-party data for this activity?