Ask where personal information goes and what happens to it.

What information is involved?

Identify source records, prompts, retrieved material, generated outputs and logs. Some outputs may contain or infer information about people.

Consider who receives or can access the information, including vendors and integrations.

What is the purpose?

Explain why the information is needed and how the intended use relates to the organisation's existing practices. Availability is not the same as permission for any new purpose.

A blanket consent statement is not a substitute for understanding the applicable requirements.

What does the provider do?

Check the actual product terms and configuration: processing, training use, retention, deletion, locations, access and incident arrangements.

Do not assume every account type or service from the same brand has identical terms.

Can the organisation manage quality and controls?

Assess information accuracy for the intended use, appropriate safeguards and relevant individual rights. Assign owners for review and correction where applicable.

A policy should connect to the implemented workflow and what users actually do.

Does automated-decision disclosure need assessment?

The new APP 1 provisions apply to arrangements meeting particular conditions. Using AI does not automatically establish scope, and a non-AI rules engine is not automatically outside it.

Read the APP 1.7 guide.

For a detailed operating review, map the information practice and seek qualified advice on the organisation's circumstances.