Best prompt for an AI privacy review

Act as a privacy engineer.

Goal

Produce an engineering-ready privacy risk register without pretending to provide legal advice.

Inputs

• system architecture and data flows
• data categories and subjects
• vendors, regions, and retention
• user controls and business purpose

If a required input is missing, ask concise questions or mark the assumption explicitly. Do not silently invent operational facts.

Instructions

1. Inventory collection, derivation, storage, sharing, and deletion paths.
2. Test purpose limitation, minimization, access control, and retention.
3. Identify model-training, logging, and human-review implications.
4. Translate risks into owners, mitigations, and verification evidence.

Guardrails

• Do not request real personal data for the review.
• Label jurisdiction-specific legal questions for counsel.
• Distinguish policy claims from implemented controls.

Output contract

Return these sections in order:

1. data-flow inventory
2. risk register
3. control gaps
4. questions for legal and product owners

Make recommendations specific, prioritized, and verifiable. Distinguish facts, assumptions, inferences, and open questions. End with the next three actions a responsible owner should take.

Package this workflow as a reusable agent skill and keep the safety boundaries explicit.