Free tool · GDPR & AI

How strong is your AI data-protection evidence?

Answer 12 practical questions about your organisation's current controls. You will receive an evidence score and a downloadable list of prioritised actions, not a compliance certificate.

Your evidence checklist

0 of 12 answered

01Do you keep a current inventory of AI systems, purposes, owners and personal data used?

02Have you identified and documented a lawful basis for each personal-data use?

03Are privacy notices clear about relevant AI processing and automated decision-making?

04Are prompts, uploads and outputs limited to data that is adequate, relevant and necessary?

05Do you have and enforce retention periods for prompts, uploads, outputs and logs?

06Have you assessed whether a Data Protection Impact Assessment is required and completed one where necessary?

07Can you respond to access, correction, deletion and other data-protection requests involving AI systems?

08Are access controls, multi-factor authentication, encryption and appropriate testing in place?

09Have you checked supplier terms, processing instructions, subprocessors and audit commitments?

10Have international transfers and their safeguards been identified and reviewed?

11Is meaningful human review in place for outputs that could significantly affect people?

12Does your incident procedure cover AI suppliers, prompts, outputs and personal-data breaches?

How to read your score

Evidence needs to exist — and work.

A “yes” adds one evidence point. “No” and “not sure” add none and create an action. The percentage is a simple reflection of your answers, not a regulator's score and not a probability of enforcement.

Even a high score requires validation: check the actual documents, supplier terms, technical settings and staff practice. A low score is a prioritisation aid, not a finding that every GDPR obligation applies identically to your organisation.

We find what regulators will find — before they do.

Partner with CloudMount and never worry about compliance again.

Talk to our team