Prompt
Privacy & Data Protection AI prompts for lawyers
16 prompts you can paste straight into HAQQ or any other assistant. Every one is written out in full. Open it, copy it, change the bracketed parts.
Cross-Border SaaS: Hosting, Users and RegulatorMemoEnterpriseCompliance / Due Diligence
A software company in [country] is selling a SaaS contract to a [bank / regulated entity] in [country]. Data will be hosted in [location], with end users across [countries]. Advise the software company: 1. Which data protection regimes actually apply, and on what connecting factor for each: establishment, targeting, the location of the data, or the customer's own regulatory obligations flowing down. 2. The transfer mechanism needed for each cross-border flow, and whether hosting in a third country changes it. 3. What the customer's financial regulator will require of us as an outsourced service provider: audit rights, sub-processor approval, exit assistance, records retention, incident notification windows, and the regulator's own right of access. 4. Data localisation or residency rules that would defeat the proposed hosting location outright. This is the question that kills deals, so answer it early. 5. The contractual package: which of these belong in the MSA, the DPA and the security schedule, and what our fallback is on each of the three points the bank will not move on. 6. A dated action list for getting to signature. Mandatory rules: name each law and article. Where a rule is issued by a regulator rather than a statute, say which regulator and which circular. Where you are not certain a requirement is in force, mark it for verification rather than stating it flatly.
Privacy PolicyPolicyAdvancedDraft / Generate
Draft a privacy policy for [Company], which operates [describe business] in [jurisdictions]. I am advising [Company] as the controller. Facts: categories of personal data collected [details], purposes of processing [details], any special category or children's data [yes/no, details], data shared with third parties or processors [details], international transfers involved [yes/no, destinations]. Produce: 1. The data collection and use section: what is collected, from whom, and why, tied to a specific legal basis for each purpose under the law of each jurisdiction listed, not one basis for everything. 2. Retention: a period or a criterion for each category of data, not a single blanket period. 3. Individual rights available in each jurisdiction, how to exercise them, and the response timeline. 4. International transfers: the mechanism relied on for each destination, and what happens if that mechanism is unavailable. 5. Cookies and tracking technologies, consistent with what [Company]'s site or product actually deploys. 6. Contact details for privacy inquiries and, where the law requires one, the identity of the data protection officer or representative. Mandatory rules: do not assert a legal basis or a retention period that is not tied to a named provision or a documented business reason. Where a jurisdiction's requirement differs from the others listed, flag the difference rather than drafting one clause for all of them, and mark anything that needs confirmation from [Company] before publication.
Data Processing AgreementAgreementAdvancedDraft / Generate
You are drafting a data processing agreement under which [Processor] will process personal data on behalf of [Controller] for [describe processing activities]. Governing framework: GDPR Article 28, and the equivalent local implementing law where the parties operate outside the EU. Facts: processor [Processor], controller [Controller], processing activities [describe processing activities]. Deliverables: 1. The Article 28 mandatory terms: subject matter, duration, nature and purpose of processing, types of personal data, categories of data subjects. 2. Security measures the processor must implement, tied to the risk of the processing described. 3. The sub-processor approval process, including notice period and the controller's right to object. 4. Audit and inspection rights, including frequency and cost allocation. 5. Data breach notification obligations, including the timeframe for notifying the controller. 6. International transfer provisions if processing occurs outside the controller's jurisdiction. Mandatory rules: quote the Article 28 requirement you are implementing rather than paraphrasing it. Do not state a specific notification deadline or penalty figure unless it is given in the facts or in the quoted provision; flag it for confirmation instead.
Cookie PolicyPolicyAdvancedDraft / Generate
You are drafting a cookie policy for [Company's] website, to be published as a public facing compliance document. Facts: website operator [Company's], jurisdiction whose cookie rules apply [jurisdiction]. Deliverables: 1. Plain language explanation of what cookies are and why the site uses them. 2. A table of cookie categories used (essential, analytics, marketing), with purpose and typical duration for each. 3. Third party cookies: which third parties set them and what they are used for. 4. How a user can view, accept, reject, or withdraw consent for each category, and how that choice is enforced technically. 5. Contact details for cookie related queries and a last updated date. Mandatory rules: do not state that the policy complies with [jurisdiction] requirements as a bare assertion; identify the specific consent or disclosure requirement it is meeting, and flag anything that depends on facts not given, such as the actual cookies fired on the site, for the client to confirm before publication.
Data Subject Access Request ProcedurePolicyAdvancedDraft / Generate
Draft an internal procedure for [Company] to handle data subject access requests under GDPR/[applicable law]. I am advising [Company] as the controller. Facts: systems and data stores holding personal data [list], the team currently responsible for intake [details], the statutory response deadline and any extension available under [applicable law]. Produce: 1. Intake and identity verification: how a request is logged, and the verification steps proportionate to the sensitivity of the data held, without demanding more identification than the request justifies. 2. The search protocol: which systems must be searched, in what order, and who signs off that the search was complete. 3. The response timeline, counted from the correct trigger date, with the escalation point if a deadline is at risk. 4. The exemptions assessment: the grounds available under [applicable law] for withholding or redacting material, applied item by item rather than to the request as a whole. 5. The format of the response, and how third-party personal data mixed into the same records is handled. 6. Escalation and sign-off: who approves the final response, and the record to keep of the decision. Mandatory rules: cite the article of [applicable law] behind each verification step, deadline and exemption. Do not withhold or redact anything without recording the specific ground relied on, and flag for legal review any request that raises a novel or contested exemption.
Data Breach Response PlanPolicyAdvancedDraft / Generate
Draft a data breach response plan for [Company], governed by [applicable law]. I am advising [Company] as the controller. Facts: the systems and categories of personal data in scope [details], the incident response team already in place [details], the regulator with jurisdiction and its published notification channel [details]. Produce: 1. Detection and internal reporting: how an incident is first flagged and to whom, and the clock that starts running from that moment. 2. Initial assessment: how to classify severity and decide, on a documented basis, whether the incident meets the threshold for regulator or individual notification. 3. Containment and remediation measures, and who has authority to take each without further sign-off. 4. Regulator notification: the deadline under [applicable law], the information the notification must contain, and what to do if full information is not yet available by the deadline. 5. Notification to affected individuals: the trigger for it, the content, and the channel. 6. Documentation and post-incident review: what must be recorded regardless of whether notification was required, and who reviews the response afterwards. 7. Assigned responsibilities: a named role, not a department, for each action above. Mandatory rules: cite the article or provision of [applicable law] behind each deadline and each notification threshold. Do not state a notification deadline you cannot tie to a named provision, and flag any step where the regulator's actual practice may differ from the statutory text.
Employee Privacy NoticePolicyAdvancedDraft / Generate
Draft an employee privacy notice for [Company], governed by [applicable law]. I am advising [Company] as the employer. Facts: categories of employee data collected [details], any monitoring in place (email, location, CCTV, productivity tools) [details], group entities that receive employee data and their locations [details]. Produce: 1. What is collected and from whom (the employee, managers, third-party providers such as payroll or benefits), by category. 2. The purpose and the legal basis for each category, distinguishing what rests on consent, contract, legal obligation, or legitimate interest, since an employment relationship makes consent a weak basis for most of these. 3. Retention periods by category, tied to a limitation period, a statutory record-keeping duty, or a stated business reason. 4. Monitoring practices: what is monitored, the legal basis, and how employees are told, since undisclosed monitoring is often unlawful even where the underlying purpose is legitimate. 5. Employee rights and how to exercise them internally. 6. International transfers within the corporate group: the destinations and the mechanism relied on for each. Mandatory rules: cite the article or provision of [applicable law] behind each legal basis and each retention period. Do not describe a monitoring practice as lawful without naming its basis, and flag any transfer whose mechanism has not been confirmed by [Company]'s data protection team.
Vendor Data Protection AddendumAgreementAdvancedDraft / Generate
You are drafting a data protection addendum to attach to vendor agreements where [Vendor] may access or process personal data controlled by [Company]. Facts: vendor [Vendor], controller [Company], nature of the vendor's access or processing as described in the underlying agreement. Deliverables: 1. Processor obligations: process only on documented instructions, confidentiality of personnel, assistance with data subject requests. 2. Security requirements, scaled to the sensitivity of the data the vendor will access. 3. Sub-processing restrictions, including notice and objection rights for [Company]. 4. Audit rights: scope, frequency, and who bears the cost. 5. Cross border transfer mechanism, naming the safeguard used, such as standard contractual clauses, rather than assuming one applies. 6. Consequences of a security incident, including the notification timeline. Mandatory rules: quote the underlying agreement's defined terms rather than inventing new ones. Do not state that a specific transfer mechanism is valid for [Vendor]'s location unless that location is given; otherwise flag it for confirmation.
Data Retention PolicyPolicyAdvancedDraft / Generate
You are drafting a data retention policy for [Company], covering all categories of personal and business data it holds. Facts: business [Company], the data categories and systems in scope as described by the client. Deliverables: 1. A retention schedule by data category, with the retention period and the legal or business reason behind each. 2. Secure deletion and anonymization procedures at the end of each retention period. 3. The litigation hold protocol: how a hold is triggered, communicated, and lifted. 4. Roles and responsibilities for policy compliance, including who approves exceptions. 5. Review cycle for the policy itself. Mandatory rules: do not invent a specific statutory retention period; state a period only where it is given in the facts or can be attributed to a named law, and flag every other period as one for the client's legal or compliance team to confirm.
Privacy Impact AssessmentReportAdvancedCompliance / Due Diligence
You are conducting a privacy impact assessment for [Company's] proposed [project/system/product], which will process [describe personal data]. Governing framework: GDPR Article 35, and the equivalent local requirement if the project also operates outside the EU. Facts: organization [Company's], project [project/system/product], personal data involved [describe personal data]. Deliverables: 1. Description of the processing: purpose, scope, context, and data flows. 2. Necessity and proportionality assessment against the stated purpose. 3. Risk identification: likelihood and severity of each risk to individuals. 4. Existing and planned safeguards, mapped against each risk identified. 5. Consultation needs, including whether the data protection officer or supervisory authority should be involved. 6. Recommended mitigating measures, ranked by the risk they address. Mandatory rules: do not assert that Article 35 requires this assessment without confirming the processing meets the high risk threshold; if that threshold is not established by the facts given, say so and flag it for confirmation.
Cross-Border Data Transfer AssessmentMemoAdvancedCompliance / Due Diligence
You are advising on whether it is lawful to transfer personal data from [origin country/region] to [destination country]. Facts: origin [origin country/region], destination [destination country], the categories of personal data and the purpose of the transfer as described by the client. Deliverables: 1. Whether an adequacy decision covers the destination; if none is given in the facts, say so rather than assuming one exists. 2. The appropriate safeguard available if there is no adequacy decision: standard contractual clauses, binding corporate rules, or another recognized mechanism, and why it fits this transfer. 3. A Schrems II style assessment of the destination's surveillance and access laws, and the supplementary measures needed to address any gap. 4. Practical risk if the transfer proceeds without supplementary measures. 5. A recommendation on whether to proceed, pause, or restructure the transfer. Mandatory rules: do not state that a named adequacy decision or safeguard applies to [destination country] unless you can identify it; otherwise flag it for confirmation against the current list before this assessment is relied on. This assessment is an analysis aid for a qualified practitioner, not a substitute for formal legal advice on this transfer.
AI System Data Governance FrameworkPolicyAdvancedDraft / Generate
You are drafting a data governance framework for [Company's] AI and machine learning systems. Facts: organization [Company's], the systems and their intended use as described by the client. Deliverables: 1. Training data requirements: sourcing, quality, and lawful basis for use. 2. Bias identification and mitigation measures across the data lifecycle. 3. Data minimization and purpose limitation controls specific to model training and inference. 4. Transparency obligations toward individuals whose data is used or affected. 5. Individual rights in automated decision making, including how a human review request is handled. 6. Governance roles: who owns the framework, who approves exceptions, and how it is audited. Mandatory rules: AI specific regulation is still moving in most jurisdictions. Do not cite a specific AI law as governing this framework unless the client has named it; otherwise describe the obligation in general terms and flag the applicable regulation for confirmation. Cite the article or provision behind every obligation you state, and mark anything you cannot attribute to a named instrument as requiring confirmation rather than asserting it.
Third-Party Data Sharing AgreementAgreementAdvancedDraft / Generate
You are drafting a data sharing agreement between [Company A] and [Company B] for sharing [describe data] for [describe purposes]. Facts: sharing parties [Company A] and [Company B], data shared [describe data], purpose [describe purposes]. Deliverables: 1. Controller to controller responsibilities: what each party is accountable for once it holds the data. 2. The legal basis each party relies on for its own processing. 3. Data subject notification: what individuals are told, by whom, and when. 4. Security standards each party must meet before receiving data. 5. Limitations on further sharing, including any prohibition on sale or onward transfer. 6. Liability allocation if one party's processing causes a breach or a regulatory complaint. Mandatory rules: do not assert a specific legal basis, such as legitimate interest, applies to either party's processing without the facts to support it; flag it for the party's own legal assessment instead.
AI Governance PolicyPolicyExpertDraft / Generate
Act as counsel advising [organization] on AI governance, under the law of [jurisdiction]. Draft an AI governance policy covering: 1. Responsible AI use principles. 2. A risk assessment framework. 3. Bias detection and mitigation. 4. Transparency requirements. 5. Human oversight mechanisms. 6. Data handling for AI training. 7. Vendor evaluation criteria. 8. Incident response procedures. Mandatory rules: do not state that this policy satisfies a specific AI regulation, such as the EU AI Act or another named law, unless you cite the actual provision it maps to. Mark any obligation you cannot attribute to a named regulatory source as needing confirmation with regulatory counsel.
Regulatory Research Memo (Verify-Before-Cite)MemoAdvancedResearch / Authorities
Act as compliance counsel. Research the current requirements under [name the regulation or framework] as they apply to [describe the company's activity] in [jurisdiction]. Structure the answer as: the specific obligation, the statutory or regulatory section it comes from, the deadline or trigger event, and the penalty for non-compliance. If you are not certain a citation is current or correctly numbered, say so explicitly and tell me to confirm it against the official regulator text rather than presenting your best guess as settled law.
Obligation Calendar Under a Named MENA Data Protection LawChecklistExpertCompliance / Due Diligence
Act as privacy counsel building an obligation calendar for [ORGANISATION], a [SECTOR] business processing personal data of individuals in [COUNTRY], under [NAMED LAW: for example the Saudi Personal Data Protection Law (Royal Decree M/19) and its Implementing Regulations, UAE Federal Decree-Law No. 45 of 2021, DIFC Data Protection Law No. 5 of 2020, Bahrain Law No. 30 of 2018, or Qatar Law No. 13 of 2016]. Work only from that named law and its implementing regulations. Cite the article for every obligation; where a deadline, threshold, fee or retention period is not stated in the text you are working from, write "not specified in source, confirm" rather than supplying a number. Return: (1) Applicability: whether and why the law reaches this organisation, including any extraterritorial hook, sector carve-out or free-zone regime that displaces it; (2) Registration and Filings, any registration, licence, appointment or regulator notification, with the article and the event that triggers it; (3) Recurring Obligations, a calendar of what must be done and on what cadence (records of processing, impact assessments, reviews, training, audits), each with article, internal owner and frequency; (4) Event-Driven Deadlines, the clock that starts on a personal-data breach, a data-subject request, a cross-border transfer or a change of processor, with the article and how the period is counted; (5) Cross-Border Transfer Conditions: the permitted grounds, any approval or adequacy step, and any localisation requirement, each cited; (6) Roles and Contract Terms, whether a data protection officer or local representative is required and on what trigger, the controller-processor split, and the clauses the law requires in processor agreements; (7) Enforcement Exposure, the sanctions the law itself provides for, quoted from the text, with no estimate of likelihood; (8) Gap List and Evidence, measured against [CURRENT PRACTICE], what is missing and what artefact [ORGANISATION] must be able to produce to demonstrate compliance, plus the open questions for local counsel. Current practice: [DESCRIBE].