Map a vendor’s data flows for a privacy review
Key facts
- Human involvement
- GreenLawyer review
- How AI is used
- From the contract, the data-flow diagram, and the system list the lawyer supplies, list each category of data, the system that holds it, the recipient, and the purpose the document states. Do not decide whether a transfer is lawful.
- What the lawyer must review
- Rule 1.6(a) forbids revealing information relating to the representation unless the client gives informed consent, the disclosure is impliedly authorized, or paragraph (b) permits it. Rule 1.6(c) requires reasonable efforts against unauthorized access. Formal Opinion 512 requires the lawyer to understand whether a tool retains prompts or uses them to train a model. Cal. Civ. Code § 1798.140(ag) defines a service provider as a person that processes personal information on behalf of a business under a written contract with the stated prohibitions.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, verify the evidence, resolve exceptions and approve the final output for its intended use. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.