Purpose of the Template
AI tools are being adopted faster than privacy teams can review them, increasing the risk of violating EU and UK data privacy rules. These tools often require more data, conflicting with the GDPR's goal of minimizing data collection. This can happen without consent or transparency about data usage.
This template provides your Privacy Office with a single intake record for any AI tool handling personal data. It requires three decisions before deployment: what data the tool needs (data minimization, Article 5(1)(c)), the lawful basis for processing (Article 6, plus Article 9 for Special Categories of Data), and what individuals will be informed (Articles 13 and 14). It also updates your Data Processing Register and indicates when a DPIA under Article 35 is necessary.
Prerequisites
Before implementing this template, ensure you have:
- An up-to-date Data Processing Register for cross-referencing
- A designated owner for each AI tool (business sponsor, not just IT)
- Your current DPIA template and screening criteria
- A vendor contract or terms of service, including clauses on using customer data for model training
- Agreement from procurement that no AI tool launches without a completed intake record
The Template
Copy the block below into your GRC Platform, ticketing system, or a controlled document. Every field is mandatory unless marked optional.
AI TOOL PRIVACY INTAKE RECORD
SECTION 1: IDENTIFICATION
Tool name and version: ______________________
Vendor and processing location(s): ______________________
Business owner: ______________________
Intended purpose (one sentence, specific): ______________________
Go-live date requested: ______________________
SECTION 2: DATA INPUTS
2.1 Categories of personal data the tool will receive:
[ ] Contact details [ ] Employee data [ ] Customer data
[ ] Free-text fields likely to contain personal data
[ ] Special Categories of Data (specify): ______________
[ ] Children's data
2.2 For each category, why is it necessary for the stated purpose?
______________________
2.3 Which categories could be removed, masked, pseudonymized,
or replaced with synthetic data without defeating the
purpose? ______________________
2.4 Retention period for inputs and outputs: ______________
SECTION 3: MODEL TRAINING AND VENDOR USE
3.1 Does the vendor use our data to train or improve its models?
[ ] Yes [ ] No [ ] Unknown (blocks approval)
3.2 If yes, can this be disabled contractually or by configuration?
______________________
3.3 Vendor role: [ ] Processor [ ] Joint controller [ ] Controller
3.4 Article 28 processing terms in place? [ ] Yes [ ] No
3.5 International transfers and transfer mechanism: ____________
SECTION 4: LAWFUL BASIS AND CONSENT
4.1 Lawful basis relied upon: ______________________
4.2 If consent: how is it captured, recorded, and withdrawn?
______________________
4.3 If legitimate interests: attach balancing test reference.
4.4 Is the purpose compatible with the purpose the data was
originally collected for? [ ] Yes [ ] No [ ] Needs review
SECTION 5: TRANSPARENCY
5.1 Privacy notice updated to describe the AI processing?
[ ] Yes (link) ______ [ ] No
5.2 Does the tool support automated decisions with legal or
similarly significant effects (Article 22)? [ ] Yes [ ] No
5.3 How will individuals be told an AI tool is involved?
______________________
SECTION 6: [INDIVIDUAL RIGHTS](/glossary/individual-rights)
6.1 Can personal data be located and deleted in the tool's
inputs, logs, and outputs? ______________________
6.2 Process for handling a [Data Subject Request](/glossary/data-subject-request) that touches
this tool: ______________________
SECTION 7: RISK DECISION
DPIA required? [ ] Yes [ ] No Reference: ______________
Residual risk rating: ______________
Conditions of approval: ______________________
Approved by (Privacy Officer): ____________ Date: ________
Next review date: ______________
Customizing the Template
Section 2 focuses on data minimization. Question 2.3 is crucial. It requires the business owner to justify each data category instead of defaulting to "send everything." If a field's necessity can't be explained, it should be removed. Add specific data type checkboxes for your sector.
Section 3 addresses vendor training. If a tool uses your data to improve models, it represents a new data purpose. Treat "Unknown" as a blocker. If your contracts are standardized, include a field pointing to the specific clause.
Section 4 aligns with your lawful basis strategy. If your organization seldom relies on consent for AI processing, adjust 4.2 and expand legitimate interests prompts. For operations in both the UK and EU, add a line for UK GDPR and ICO guidance references.
Section 5 enhances transparency. Ensure the privacy notice clearly names the AI processing and its purpose. Consider layered notices or just-in-time notices at data entry points.
Section 7 should reflect your Impact Tolerance. Predefine triggers for a mandatory DPIA, such as Special Categories of Data or unknown vendor training use. This removes case-by-case debates.
For larger programs, integrate the form into your Integrated Risk Management (IRM) Platform for automatic tracking of approvals, evidence, and review dates linked to your Data Processing Register.
Validation Steps
A template is only effective if it changes behavior. Test it before making it mandatory.
- Pilot on three existing tools. Apply the form to your most-used AI tools retroactively. Expect gaps, especially in Sections 3 and 5.
- Reconcile with the Data Processing Register. Ensure every approved tool has a matching register entry with consistent purposes, categories, and retention periods. Mismatches indicate documentation drift.
- Test the minimization challenge. Review a completed record to see if any data category was removed or masked due to question 2.3. If nothing changes, the form is being treated as mere paperwork.
- Verify the notice. Read your public privacy notice as an individual would. Can they understand that an AI tool processes their data and for what purpose?
- Run a Data Subject Request drill. Simulate an access or erasure request involving one tool and confirm the answer to 6.1 is accurate.
- Schedule recurrence. AI vendors frequently change terms and features. Set the review date in Section 7 to trigger reassessment on any material change, not just annually.
Log any approved-with-conditions tools in your Policy Exception Registry to keep open conditions visible until resolved.
