Apply / your decision record

Make the call.
Explain your decision.

Identify the facts that matter, any missing evidence and the next action. Name the responsible role and explain what would change your decision. Do not assume that an unmentioned approval, exception or assessment exists. Allow around 8–12 minutes.

One useful record

YOUR CASE / AI AND DATA PROTECTION

A lender wants to combine applicants' account histories with social-media data to generate a credit score and automatically reject applications below a threshold. The supplier says the AI Act classification covers privacy. Staff propose collecting ethnicity data to test fairness without further review.

Your output / a practical record

GDPR and AI Act screening record

Make the next decision explicit. Connect it to evidence, unresolved questions and an accountable role.

Draft: GDPR and AI Act screening record

1. Processing purpose, people and data sources2. Controller/processor roles and lawful basis3. Necessity, minimisation and Article 9 conditions4. Notices, rights, transfers and security5. Article 22, DPIA and FRIA scope6. Controls, residual risk, consultation and approval

Check your reasoning

I identified the lender's data sources, proposed automated rejection and affected applicants.I kept lawful-basis, sensitive-data and assessment questions separate from the AI Act label.I named the specialist reviews and controls required before proceeding.I recorded data minimisation, rights, transfers and unresolved assessment evidence.

This is a self-review. Compare with the worked example if you need help. Every field needs a response of at least 10 characters; text length does not assess its quality.