Módulo 5: GDPR for AI Systems
Proyecto: GDPR Compliance Checklist for AI
Descripción
Cerramos M5 con un deliverable accionable: una GDPR Compliance Checklist específica para AI systems. No es genérica — es para tu sistema concreto.
Esta checklist se vuelve parte del Responsible AI Framework (M7) y del Ethics Audit Report (M8). Es artifact reutilizable para cada AI project futuro.
Al terminar este proyecto vas a tener:
- GDPR Compliance Checklist (25-30 ítems verificables) específica para AI
- Cada ítem con: criterio, status (Yes/No/N/A), evidence required
- Categorizada por área: Art. 22, consent, minimization, documentation, DPO
- Lista para aplicar en audit interno o externo
Template del checklist
# GDPR Compliance Checklist — AI Systems
**Version**: 1.0
**Last reviewed**: 2026-MM-DD
**Reviewer**: [Name]
**System**: [System name]
## Section 1: Automated Decision-Making (Art. 22)
[ ] 1.1 Does the system make decisions solely based on automated processing
that produce legal effects or similarly significantly affect users?
- Yes → Continue to 1.2-1.6
- No → Skip to Section 2
Evidence: [link to decision flow diagram]
[ ] 1.2 Does the system fall under one of the Art. 22(2) exceptions?
- (a) Contract necessity
- (b) Authorized by Union/Member State law
- (c) Explicit consent
Evidence: [link to legal basis documentation]
[ ] 1.3 Is meaningful information about the logic involved provided to data subjects?
Evidence: [link to user-facing explanation samples]
[ ] 1.4 Are the consequences of the decision communicated clearly?
Evidence: [link to notification templates]
[ ] 1.5 Can data subjects obtain human intervention upon request?
- Process documented and operational
Evidence: [link to human review workflow + SLA]
[ ] 1.6 Can data subjects contest the decision?
- Process documented
Evidence: [link to appeal process]
## Section 2: Lawful Basis (Art. 6)
[ ] 2.1 Each processing activity has a documented lawful basis
Evidence: [link to RoPA showing basis per activity]
[ ] 2.2 If consent is used:
- Specific, granular consent for AI processing
- Separate from other consents
- Revocable as easily as granted
Evidence: [link to consent UX + flow + logs]
[ ] 2.3 If legitimate interest is used:
- LIA documented and current
- Right to object implemented
Evidence: [link to LIA + objection process]
[ ] 2.4 No sensitive data (Art. 9) processed without specific Art. 9 basis
Evidence: [data inventory showing no sensitive without basis]
## Section 3: Data Minimization (Art. 5(1)(c))
[ ] 3.1 Training data necessity documented per field
Evidence: [link to data inventory with justifications]
[ ] 3.2 Anonymization or pseudonymization applied where possible
Evidence: [link to anonymization procedure]
[ ] 3.3 Excessive data fields removed (only necessary fields retained)
Evidence: [comparison of "available" vs "used" fields]
[ ] 3.4 Inference data minimal — only what's needed for current query
Evidence: [code review samples / inference logs]
## Section 4: Transparency (Art. 12-14)
[ ] 4.1 Privacy policy clearly mentions AI processing
Evidence: [link to privacy policy with AI section]
[ ] 4.2 Users informed of automated decision-making (where applicable)
Evidence: [user-facing notifications]
[ ] 4.3 Cookie/consent banner specifically lists AI processing
Evidence: [screenshot of banner]
[ ] 4.4 Data subject can request information about data held about them
Evidence: [data export/access process]
## Section 5: Data Subject Rights (Art. 15-22)
[ ] 5.1 Right of access — data subject can obtain copy of their data
- SLA: 1 month
Evidence: [process documentation]
[ ] 5.2 Right to rectification — corrections can be made
Evidence: [correction process + verification]
[ ] 5.3 Right to erasure — data deletion supported
- Including impact on trained models documented
Evidence: [deletion process + model implications]
[ ] 5.4 Right to portability — data exportable in machine-readable format
Evidence: [export endpoint or download feature]
[ ] 5.5 Right to object — objection mechanism functional
Evidence: [process + SLA + handling docs]
[ ] 5.6 Right to challenge automated decisions (Art. 22(3))
Evidence: [human review process]
## Section 6: International Transfers (Art. 44-50)
[ ] 6.1 All third-country transfers identified
Evidence: [data flow mapping]
[ ] 6.2 Adequate safeguards in place (SCCs, BCRs, or adequacy decision)
Evidence: [link to SCCs with each processor]
[ ] 6.3 Privacy policy mentions international transfers
Evidence: [policy section]
## Section 7: Security (Art. 32)
[ ] 7.1 Encryption at rest implemented
Evidence: [config docs]
[ ] 7.2 Encryption in transit (TLS 1.2+)
Evidence: [SSL config]
[ ] 7.3 Access controls (RBAC) implemented
Evidence: [access matrix]
[ ] 7.4 Audit logs maintained
Evidence: [log samples + retention policy]
[ ] 7.5 Breach notification procedure documented
- 72-hour notification capability
Evidence: [incident response runbook]
## Section 8: Documentation (Art. 30)
[ ] 8.1 Records of Processing Activities (RoPA) maintained
Evidence: [link to RoPA]
[ ] 8.2 RoPA reviewed annually
Evidence: [last review date documented]
[ ] 8.3 DPIA conducted for high-risk processing
Evidence: [link to DPIA]
[ ] 8.4 DPIA reviewed when significant changes occur
Evidence: [DPIA version history]
## Section 9: DPO
[ ] 9.1 DPO designation decision documented
- Required (justification) OR designated as best practice
Evidence: [decision documentation]
[ ] 9.2 If DPO designated:
- Contact info published
- Independence assured
Evidence: [organizational chart + privacy policy]
## Section 10: AI-Specific
[ ] 10.1 Training data sources documented
Evidence: [data inventory]
[ ] 10.2 Bias testing conducted (link to M2 bias audit)
Evidence: [bias audit report]
[ ] 10.3 Model decisions can be logged and reconstructed
Evidence: [logging architecture]
[ ] 10.4 Re-training procedure documented (for erasure requests impact)
Evidence: [training procedure]
[ ] 10.5 Third-party AI services (OpenAI, etc.) have DPAs in place
Evidence: [DPAs with each provider]
## Status Summary
- Total items: 30
- Yes: __
- No: __
- N/A: __
- Compliance percentage: __%
## Critical Gaps (No items)
1. [Item number and brief description]
2. ...
## Action Plan
| Item | Priority | Owner | Target date |
|------|----------|-------|-------------|
| ... | Critical/High/Medium | ... | ... |
---
## Review schedule
- Quarterly: review changes to system that affect compliance
- Annually: full re-review of all items
- Ad-hoc: when major changes (new model, new data source, new processing activity)Cómo trabajar el proyecto
Sugiero este orden (~3 horas):
- Setup (15 min): copy template, fill metadata
- Section 1 (Art. 22) (30 min): analyze your system for automated decisions
- Section 2-3 (Bases + Minimization) (45 min): document each processing activity
- Section 4-5 (Transparency + Rights) (30 min): your user-facing processes
- Section 6-7 (Transfers + Security) (20 min): infrastructure docs
- Section 8-9 (Documentation + DPO) (15 min): organizational
- Section 10 (AI-Specific) (20 min): your AI components
- Status summary + Action plan (15 min): prioritize gaps
Total: ~3 horas para versión inicial defendible.
Criterios de evaluación
Tu checklist es production-ready si:
- Cada item tiene status definitivo (no "TBD")
- Each "Yes" tiene evidence link/reference
- Each "No" está en el action plan
- Action plan tiene priorities y owners
- Review schedule definido
- Versionado (this is v1.0, futuros updates trackeados)
Cómo se integra con otros módulos
| Module | How it feeds this checklist |
|---|---|
| M3 (Privacy fundamentals) | Section 3 (minimization), Section 4 (transparency) |
| M4 (EU AI Act) | Section 1 (Art. 22 overlap), Section 10 (high-risk) |
| M6 (Standards) | Section 7 (security maps to ISO controls) |
| M7 (Framework) | This checklist becomes part of the framework |
| M8 (Ethics Audit) | This checklist is applied during the audit |
Evidence de éxito al terminar M5
Vas a saber que terminaste bien si:
- ✅ Checklist completa con 25-30+ items, cada uno verificable
- ✅ Status definido para cada item (no TBD)
- ✅ Evidence linkeado o referenced para each Yes
- ✅ Action plan para each No
- ✅ Review schedule + ownership defined
- ✅ Checklist could pass external audit (DPA inspection)
Módulo 5 completado
Pasaste de "GDPR es complejo y vago" a tener herramientas concretas:
- ✅ Art. 22 (automated decisions) en detalle
- ✅ Right to explanation para LLMs con estrategias prácticas
- ✅ Data minimization aplicada a training + inference
- ✅ Consent granular vs Legitimate Interest
- ✅ Documentation + DPO + DPIA
- ✅ Checklist accionable
Siguiente módulo
Módulo 6 — Industry Standards and Frameworks. Tenés regulación (EU AI Act M4, GDPR M5). Ahora aprendés los standards voluntarios (NIST AI RMF, IEEE 7000, ISO 42001) que complementan regulación con processes implementables.
Recursos
- ICO GDPR Compliance Checklist.
- EDPB Compliance Templates.
- GDPR enforcement tracker — para learn from violations.
- OneTrust / TrustArc tools — compliance software.
- Privacy Patterns library — design patterns para privacy.