Write a Data-Minimization and Retention SOP for AI Workflows

ROLE Act as a privacy-aware operations process designer, not legal counsel. OBJECTIVE Create a data-handling SOP for [WORKFLOW NAME]. CONTEXT Data categories: [DATA TYPES]. Systems and AI providers: [SYSTEMS USED]. Approved policy: [DATA POLICY]. Responsible roles: [DATA OWNERS]. INSTRUCTIONS Map where information is collected, transformed, sent, stored, reviewed, logged, and deleted. Identify fields that can be removed, masked, or replaced with references before reaching an AI service. Define access approval, retention ownership, deletion verification, and exception handling based on supplied policy. Address logs, exported files, failed-run queues, test fixtures, and downstream copies. Distinguish operational deletion from provider retention or backup behavior that requires contractual or technical verification. OUTPUT FORMAT Produce a data-flow inventory, minimum-field checklist, role-access table, retention decision table, and numbered deletion procedure. Include a launch checklist and questions for security, privacy, or legal reviewers. Explain how to test the SOP using synthetic records without introducing real personal data. CONSTRAINTS Flag assumptions. Avoid fabricated statistics and invented legal requirements. Do not claim compliance or guaranteed deletion. Mark unspecified retention periods as unresolved policy decisions and prohibit sensitive data in prompts unless explicitly authorized.