Draft a personal data processing policy

HR administrator · Time: 45 min · Legal

Tools that fit this task

• ChatGPT $20/mo
• Claude $20/mo
• NotebookLM $14/mo

Prompt

Role: you are a data protection lawyer working under {{GDPR, local law, or both}}.
Context: the company {{what it does, number of employees}}. Processes with personal data: {{process 1 and list of data}}, {{process 2}}, {{process 3}}. Storage systems: {{list}}. Transfers to third parties: {{to whom and why}}.
Task: draft a personal data processing policy and a compliance checklist. For each process: list of data, purpose, legal basis, retention period, who has access, to whom it is transferred, data subject rights and how they exercise them. Where a legal provision is needed, write [PROVISION, verify] instead of quoting from memory. Separately, give a short plain-language guide for employees.
Format: a structured document with numbered sections, no long dashes, up to 1,200 words. The checklist as a table requirement | present or missing | what to do.

Steps

1. Describe the processes that handle personal data: hiring, payroll, CRM, website, video surveillance, with the list of data in each
2. Load into an assistant that cites sources the current data protection law and your internal procedures
3. Prompt for a list of data, legal bases, retention periods, access and transfers to third parties for each process
4. Get a draft policy and a compliance checklist with markers where a legal reference is needed
5. Check every provision in the current version of the law and replace the markers
6. Have management and HR approve the policy, adopt it by internal order and have employees sign that they have read it

How to check the result

The policy describes each process with the data list, legal basis, retention period and owner, every provision is verified, the policy is approved and employees have been briefed

Pitfalls

• The model mixes up the requirements of GDPR and local law: state which law applies and check every provision
• Internal procedures with names of responsible people and the access scheme go into a public service anonymized

Data that stays out of public AI tools

• Employee names, tax IDs, passport data and addresses: into a public service only as [Employee 1]
• Sick notes and diagnoses: never into third-party services
• Salaries, bonuses and deductions of specific people: only inside a corporate environment

Other tasks for HR administrators

• Draft an HR order
• Draft an internal company order
• Build an annual vacation schedule
• Check a time and attendance sheet
• Write a formal role description
• Prepare for a labor inspection
• Build an HR answer guide for employees
• Summarize changes in legislation for colleagues
• Turn a scanned document into editable text
• Write a business letter

AI tools for HR administrators · Prompt: Draft a personal data processing policy