MCCM Wiki
GDPR-safe AI workflows
A GDPR-safe AI workflow names the personal data involved, chooses an approved tool and retention path, minimizes what is pasted into prompts, keeps a human reviewer, and records who owns the process. If you cannot answer those points, do not run the workflow on live data.
SMEs do not need a 40-page AI policy to start. They need a repeatable pattern that survives the first customer file.
Classify before you paste
Split inputs into public, internal, and personal or sensitive. Personal data and secrets do not belong in consumer tools without a contract and settings that match your risk. When in doubt, redact or use synthetic examples for drafting.
Minimum viable controls
- Approved tools list (what is allowed for work data).
- Prompt rules: no passwords, no full ID copies, no HR dossiers.
- Retention: where outputs live, who deletes them.
- Access: who may run the workflow.
- Review: a human checks outbound content.
Vendor questions that matter
Where is data processed, is training on your inputs off by default, how long are logs kept, and can you export or delete them? Write the answers next to the workflow owner’s name.
Fit with MCCM pilots
Every AI pilot should include a one-page privacy note: data classes, tool, reviewer, retention. It takes less time than cleaning up a leaked paste later.
What done looks like
Staff can point to the rules without asking legal for every email draft, and a sample audit trail shows inputs were minimized and outputs reviewed.
Related
See prompt workflow, Choosing the first AI workflow, and What an AI audit should deliver.