Risk and exam
Shareable reference
A living impact assessment: purpose, lawful basis, training versus inference, vendor sub-processing, and what happens if a subject objects after go-live.
Share: https://meridian.keyteller.com/use-cases/data-rights-before-scale
A practical example
A firm wants to fine-tune or prompt a vendor model on five years of customer cases, then roll it from one desk to the network. Legal and the DPO need a live assessment before processing starts: purpose, lawful basis, training versus inference, special-category risk, access and erasure paths, vendor sub-processing, and what happens if a subject objects after go-live. Scaling without a rights path is the failure, not missing a logo on a privacy notice.
What you leave with. A data-rights map and the uses that are allowed now.
Not this. A privacy notice refresh or a vendor GDPR-ready checkbox. Calendar for this class of work is measured in weeks, not hours.
Related situations