Access & data minimization
Review permissions, least privilege and the information each workflow needs.
Processing & vendors
Assess processing locations, vendor terms, retention and model-training use.
Review & accountability
Plan human approvals, audit logs, ownership and incident workflows.
Retention & document governance
Clarify classification, owners, versions, approvals and retention expectations.