Draft a privacy or data-protection impact assessment
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Build an assessment skeleton that separates a California risk assessment from a federal-agency privacy impact assessment, and list the facts still missing. Do not conclude that the processing is permitted.
- What the lawyer must review
- The California Privacy Protection Agency states that on 24 July 2025 its Board adopted regulations, approved by the Office of Administrative Law on 22 September 2025 and effective 1 January 2026, that require certain businesses to conduct risk assessments and that give consumers rights to access and opt out of the use of automated decisionmaking technology. Open the approved regulation text before you describe what the assessment must contain or when it is due. Separately, the Justice Department's Office of Privacy and Civil Liberties states that section 208 of the E-Government Act of 2002 requires a privacy impact assessment when a federal agency develops or procures information technology that collects, maintains or disseminates information in identifiable form, or makes a substantial change to such a system. A private company is not an agency under that section. Opinion 512: do not treat a generated assessment as the lawyer's sign-off.
- Written for / version
- United States versionUSCth
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.