Draft a personal data processing policy

HR manager · Time: 45 min · Legal

Tools that fit this task

• ChatGPT $20/mo
• Claude $20/mo
• NotebookLM $14/mo

Prompt

Role: you are a data protection lawyer working under {{GDPR, local law, or both}}.
Context: the company {{what it does, number of employees}}. Processes with personal data: {{process 1 and list of data}}, {{process 2}}, {{process 3}}. Storage systems: {{list}}. Transfers to third parties: {{to whom and why}}.
Task: draft a personal data processing policy and a compliance checklist. For each process: list of data, purpose, legal basis, retention period, who has access, to whom it is transferred, data subject rights and how they exercise them. Where a legal provision is needed, write [PROVISION, verify] instead of quoting from memory. Separately, give a short plain-language guide for employees.
Format: a structured document with numbered sections, no long dashes, up to 1,200 words. The checklist as a table requirement | present or missing | what to do.

Steps

1. Describe the processes that handle personal data: hiring, payroll, CRM, website, video surveillance, with the list of data in each
2. Load into an assistant that cites sources the current data protection law and your internal procedures
3. Prompt for a list of data, legal bases, retention periods, access and transfers to third parties for each process
4. Get a draft policy and a compliance checklist with markers where a legal reference is needed
5. Check every provision in the current version of the law and replace the markers
6. Have management and HR approve the policy, adopt it by internal order and have employees sign that they have read it

How to check the result

The policy describes each process with the data list, legal basis, retention period and owner, every provision is verified, the policy is approved and employees have been briefed

Pitfalls

• The model mixes up the requirements of GDPR and local law: state which law applies and check every provision
• Internal procedures with names of responsible people and the access scheme go into a public service anonymized

Data that stays out of public AI tools

• CVs with names, contacts, photos and dates of birth: into a public service only as an anonymized version with no identifying details
• Salaries, performance ratings and reasons for dismissal of specific people: personal data, replace with [Employee 1]
• Survey answers that could identify the author: remove the details and never try to establish authorship

• Draft a personal data processing policy with Claude

Other tasks for HR managers

• Write a job ad and a job description
• Screen resumes fairly and without bias
• Prepare a structured interview
• Build a 30/60/90-day onboarding plan
• Frame feedback for an employee
• Design an engagement survey and analyze the answers
• Draft an internal company order
• Write AI usage guidelines for your team
• Write meeting minutes from an audio recording
• Write a business letter
• Write a weekly report to your manager

AI tools for HR managers · Prompt: Draft a personal data processing policy