# Worked customer-support DPIA

Fictional assessment of wording assistance for customer replies. This completed teaching record reaches a redesign decision rather than asserting the original raw-ticket use is approved.

Synthetic organisation, roles and assessment findings. Proposed safeguards have not been tested; no DPO or supervisory authority approval is claimed.

Source: https://aona.ai/resources/guides/chatgpt-dpia-worked-example/
Sources checked: 2026-09-21

## The proposed data path

### Source

Customer ticket system

Note: Keep original records in their controlled source.

### Input

Reduced or invented wording context

Note: Exclude identifiers for the teaching exercise.

### Output

Human-reviewed draft

Note: No automated reply is enabled by this example.

| Assessment element | Illustrative finding | Owner or follow-up |
| --- | --- | --- |
| Purpose and scope | Improve reply wording; no automated customer decision or sending. | Support owner defines the permitted task. |
| Original data flow | Ticket text → employee device → ChatGPT workspace → draft back to ticket. | Security maps stored copies and recipients. |
| Necessity and alternative | Generic wording examples can meet the initial purpose without raw tickets. | Support owner chooses the reduced-context design. |
| Lawfulness and transparency | Any later real-data use needs its Article 6 basis and relevant Article 9 analysis. | Privacy owner verifies grounds and information for customers. |
| Risk to individuals | Unnecessary identifiers, unexpected health details and misleading drafts could affect customers. | Privacy and support owners assess consequence and scope. |
| Proposed safeguards | No attachments/connectors in the example; generic inputs; human reply review. | Security verifies actual configuration; support tests the review procedure. |
| Residual uncertainty | Service terms, retention and effectiveness are not established for a real deployment. | Procurement and security obtain the missing evidence. |
| Illustrative decision | Do not start raw-ticket processing; begin with invented wording examples. | Reassess real-data scope and any Article 36 implications before a later change. |

## Review checklist

- [ ] Trace every retained copy
  Include the ticket, AI conversation, attachments, generated drafts and exported evidence.
- [ ] Test necessity
  Explain why a generic description or approved template would not meet the proposed real-data purpose.
- [ ] Resolve the remaining risk
  Record actual evidence and responsibilities; assess prior consultation where the legal threshold is met.

## Included example files

- chatgpt-support-dpia-example.md
- chatgpt-support-dpia-example.csv

## Source references

- EU GDPR: Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (2026-09-21)
- ICO: Guidance on AI and data protection: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/ (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.