Checklist

Data Privacy & Safe AI Use — Guardrails Checklist

Practical, actionable checklist to help teams and solo operators use AI without exposing customer data or violating trust. Includes checks for data minimization, de-identification, vendor selection, consent, access controls, logging, monitoring, and incident response—plus fields to record owner, risk level, notes, and actions.

Interactive Tool

Data Privacy & Safe AI Use — Guardrails Checklist

This interactive checklist helps you evaluate AI use cases, pipelines, tools, and prompts so you can use AI without exposing customer data or violating trust. Work through each section, record the responsible owner, an overall risk level, and any follow-up actions. Use the Notes fields to capture decisions and evidence.

Responsible person or role

Name or role responsible for this AI use case (e.g., Product Lead, Data Steward).

Date of review

YYYY-MM-DD (or a date note).

Overall privacy risk level

Estimate the level of privacy risk for this AI use case/dataflow.

--- Data Minimization ---

Section marker

Have you limited the data used to only what is necessary for the task (data minimization)?

Remove fields that are not required for model input or processing. Avoid collecting extra PII.

Where possible, are you using sampled, synthetic, or anonymized data for development and testing instead of real customer data?

Prefer synthetic datasets or realistic mock data for model development and testing to reduce exposure.

Notes on data minimization

Record fields removed, rationale, and any constraints.

--- De-identification & Pseudonymization ---

Section marker

Have direct identifiers (names, SSNs, exact addresses, phone numbers, emails) been removed or pseudonymized where not essential?

If pseudonymizing, record where mapping keys are stored and who can access them.

Has re-identification risk been assessed (e.g., uniqueness testing or expert review)?

Record test methods used or attach references to the assessment.

Notes on de-identification

Describe methods, tools, and any remaining risks.

--- Vendor & Model Selection ---

Section marker

Have you reviewed vendor privacy policies and terms to confirm whether they use customer data to train models or retain prompt/response data?

Prefer vendors that: do not retain or use your data for training, offer private or dedicated models, or provide contractual guarantees.

Does the vendor provide evidence of security controls (e.g., SOC2, ISO 27001) or relevant contractual safeguards?

Record certificates, contract clauses, or vendor contacts.

Notes on vendor and model selection

Capture vendor name, model used, data retention promises, and any contractual requirements.

--- Consent & Transparency ---

Section marker

Is there a lawful basis and, where required, documented consent or contract covering AI processing of this customer data?

If relying on consent, ensure it's specific, informed, and recorded. For processing under contract or legitimate interest, document the basis and rationale.

Is there a clear disclosure to users that AI is used and how their data will be processed/retained?

Example disclosure snippet: 'We may process your data with automated tools to provide X; only the minimum data needed will be used, and it will not be used to train external models without your consent.'

Notes on consent and disclosures

Record consent text, policy links, or where disclosures are shown.

--- Access Controls & Storage ---

Section marker

Is data encrypted at rest and in transit for this AI workflow?

Record encryption standards and any exceptions.

Are access controls in place with least-privilege principles (role-based access, limited admin accounts)?

Include any privileged access reviews or approvals.

Are API keys, tokens, and credentials stored securely (not in code or open logs) and rotated regularly?

Record where secrets are stored (vault) and rotation policy.

Notes on access and storage

Document locations, retention windows, and exceptions.

--- Prompting & Logging Practices ---

Section marker

Do prompts avoid including raw customer PII or sensitive fields?

Use placeholders or tokenization instead of pasting full data.

Are logs and audit trails configured to exclude sensitive content and to enforce short retention windows?

Record log retention policy and review frequency.

Notes on prompting and logging

Describe any prompt-preprocessors, redaction libraries, or logging filters used.

--- Monitoring, Audit & Inventory ---

Section marker

Is there an inventory of AI models, vendors, and where customer data flows (data map)?

Keep an up-to-date list of AI use cases and data sources.

Is periodic auditing scheduled for this use case (privacy review, output review, access review)?

Record the audit cadence (e.g., quarterly).

Notes on monitoring and audit

Record last audit date, findings, and remediation.

--- Emergency & Incident Response ---

Section marker

Is there a documented incident response plan specific to AI/data exposures (containment, assessment, notification)?

Plan should include who to notify, legal contacts, and communication templates.

Date incident response plan last tested

YYYY-MM-DD or 'Never'.

If an exposure occurred, what actions were taken?

Record containment steps, notifications, and lessons learned.

I confirm this checklist was completed accurately and required approvals were sought

Select 'Yes' to confirm.

Follow-up actions and owner(s)

List outstanding actions, owners, and target dates.

You can explore this tool now. Sign in or create an account to save your responses and return to them later.

Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.

Discuss Ask the Librarian

Discussion

Comments and conversation will live here.

Data Privacy & Safe AI Use — Guardrails Checklist

Data Privacy & Safe AI Use — Guardrails Checklist

Discussion

Services

Explore

Contact