C03 Ai Privacy Checklist

Checklist C03: AI & Data Privacy Pre-Launch Project Information Field Value Project Name [e.g., Keturah Creek] Review Date [DD/MM/YYYY] Reviewer [Name, Title] Technology Partner [e.g., Parsons International] 1. Data Collection & Consent Item Compliant? Evidence Notes All data collection points documented [ ] Yes [ ] No Privacy policy updated and published [ ] Yes [ ] No Consent mechanism implemented (opt-in) [ ] Yes [ ] No Consent records stored securely [ ] Yes [ ] No Data minimization principle applied [ ] Yes [ ] No Purpose limitation documented [ ] Yes [ ] No 2. Data Storage & Security Item Compliant? Evidence Notes Data encrypted at rest (AES-256) [ ] Yes [ ] No Data encrypted in transit (TLS 1.3) [ ] Yes [ ] No Access control implemented (RBAC) [ ] Yes [ ] No Multi-factor authentication enabled [ ] Yes [ ] No Data retention policy defined [ ] Yes [ ] No Backup and recovery procedures tested [ ] Yes [ ] No 3. Data Processing & Anonymization Item Compliant? Evidence Notes Personal data anonymized for analytics [ ] Yes [ ] No Anonymization techniques documented [ ] Yes [ ] No Re-identification risk assessed [ ] Yes [ ] No Data processing agreements with vendors [ ] Yes [ ] No 4. Resident Rights Item Compliant? Evidence Notes Right to access implemented [ ] Yes [ ] No Right to rectification implemented [ ] Yes [ ] No Right to erasure implemented [ ] Yes [ ] No Right to data portability implemented [ ] Yes [ ] No Self-service data portal available [ ] Yes [ ] No Response time SLA defined (<30 days) [ ] Yes [ ] No 5. Third-Party & Vendor Compliance Item Compliant? Evidence Notes Vendor data processing agreements signed [ ] Yes [ ] No Vendor security certifications verified [ ] Yes [ ] No Data transfer mechanisms compliant [ ] Yes [ ] No Sub-processor list documented [ ] Yes [ ] No 6. Security Testing Item Compliant? Evidence Notes Penetration testing completed [ ] Yes [ ] No Vulnerability assessment completed [ ] Yes [ ] No Critical/high vulnerabilities remediated [ ] Yes [ ] No Security audit report reviewed [ ] Yes [ ] No 7. Incident Response Item Compliant? Evidence Notes Incident response plan documented [ ] Yes [ ] No Incident response team identified [ ] Yes [ ] No Breach notification procedures defined [ ] Yes [ ] No Incident response drill conducted [ ] Yes [ ] No 24/7 monitoring in place [ ] Yes [ ] No 8. AI-Specific Considerations Item Compliant? Evidence Notes AI decision-making transparency documented [ ] Yes [ ] No Bias testing conducted on AI models [ ] Yes [ ] No Human oversight mechanisms in place [ ] Yes [ ] No AI model documentation complete [ ] Yes [ ] No 9. Overall Assessment Rating Description [ ] Approved for Launch All items compliant. System ready for go-live. [ ] Approved with Conditions Minor items outstanding. List conditions below. [ ] Not Approved Critical items non-compliant. Remediation required. Conditions / Required Actions: 1. 2. 3. 10. Sign-Off Role Name Signature Date AI Integration Lead Data Privacy Officer IT Security Lead Project Director