LLM Data Privacy Checklist — Before You Send User Data to a Provider

Ticks are saved in this browser only — close the tab and come back to where you were. Nothing is sent anywhere and there is no account.

0 of 20 done · 8 critical outstanding

What you send

0/5

You can list every field that reaches the provider, from memory or from code.critical
Most privacy problems are discovered here. "The whole user object" is a common and unacceptable answer.
Only fields the task genuinely needs are sent.critical
Data minimisation is a legal principle in most jurisdictions and a risk reduction everywhere. It is also the cheapest fix on this list, because unsent data needs no protection.
Direct identifiers are removed or replaced with tokens where the task does not need them.critical
Most tasks — classification, summarisation, extraction — work identically on pseudonymised text. Names are rarely load-bearing.
Check this with the pii redactor
Special category data — health, biometrics, religion, sexuality, political views — is either not sent or has its own documented basis.
These carry stricter requirements almost everywhere, and they arrive through free-text fields without anyone deciding to send them.
Free-text fields have been sampled to see what users actually put in them.
A field labelled "notes" contains everything. Any assumption about what is in it that has not been checked is wrong.
Check this with the pii redactor

Provider terms

0/5

A data processing agreement is signed with every provider in the path.critical
This is the document that makes the provider a processor acting on your instructions rather than an independent controller. Legal review required.
Training on your data is disabled, and you have verified the setting rather than assumed the default.critical
Defaults differ by provider and by plan, and consumer and API terms are frequently not the same. Check the account you are actually calling from.
The retention period is known, documented, and matches what your privacy policy claims.
Providers retain inputs for abuse monitoring by default, often for a fixed window. If your policy promises otherwise, one of the two is wrong.
You know which countries process the data, and any international transfer has a documented mechanism.
Where the compute happens determines which rules apply. Several providers offer regional processing; it is usually opt-in.
The provider's subprocessor list has been read and is monitored for changes.
Your provider has providers. Their list is part of your disclosure surface, and it changes without a release note.

Transparency and rights

0/5

The privacy policy names AI processing and the categories of provider used.critical
Users cannot consent to a disclosure that is not disclosed, and this is one of the first things a regulator or an enterprise buyer checks.
A lawful basis for the processing is identified and recorded. Legal review required.
Legitimate interest, consent and contractual necessity carry different obligations. Picking one after a complaint is worse than picking one now.
A deletion request can be honoured end to end, including anything held at the provider.critical
Deleting your own copy while a copy sits in a provider's retention window is a partial deletion, and the difference is exactly what the request was about.
You could produce everything sent about one individual if asked.
Subject access requests include what you disclosed to third parties. Per-request logging with a user identifier makes this a query rather than a project.
If model output materially affects a person — a rejection, a price, a flag — there is human review and an appeal path.
Fully automated decisions with significant effects are separately regulated in the EU and elsewhere, and this is the item most often missed.

Engineering controls

0/5

Prompts and responses in your own logs are redacted or access-controlled.critical
The provider is often the more careful custodian. An unredacted prompt log is a copy of everything, sitting where far more people can read it.
Check this with the pii redactor
Log retention is bounded and enforced automatically.
"We keep logs for thirty days" is only true if something deletes them.
No credential, key or internal endpoint appears in any prompt.
Prompts are logged by you and retained by the provider. Treat them as published.
Check this with the secret scanner
Only the intended provider endpoints are reachable from the service.
It bounds the damage of a misconfiguration or a compromised dependency, and it makes the data path auditable rather than assumed.
Adding a new provider or a new data field triggers a fresh review.
Privacy posture decays through small additions, each individually reasonable. The trigger is what stops it.

Questions

Does using an API mean the provider trains on my data?

For the major providers' business and API tiers, generally no by default — but this differs by provider, by plan and over time. Verify it in the account you are actually calling from and record when you checked.

Is redacting names enough to make data anonymous?

Almost never. Free text re-identifies through combinations — a role, a location, a date, an unusual detail. Treat redacted text as pseudonymised, which is still personal data, not as anonymous.

Do I need a DPIA?

In the EU, likely yes where processing is large scale, involves special category data, or produces decisions affecting people. That is a legal determination — this checklist prepares the technical facts it needs.