# Sensitive-data input decision map

Invented workplace tasks separate purpose, data category and the additional Article 9 question, with a distinct Article 10 example.

Synthetic employee information and proposed tasks. No actual lawful basis, consent or legal approval is established.

Source: https://aona.ai/resources/guides/gdpr-special-category-data-ai-prompts/
Sources checked: 2026-09-21

## The decision before the upload

### Need

Does the task require this personal detail?

### Grounds

Article 6 basis and Article 9 condition

### Safeguards

Recipient, contract, transfers and risk

### Instruction

A scoped rule staff can follow

| Proposed input | Category and issue | Decision in the exercise |
| --- | --- | --- |
| “Rewrite our generic sick-leave policy.” | A general policy can be discussed without anyone’s health record. | Use invented context; do not attach employee diagnoses. |
| “Explain this named employee’s diagnosis to their manager.” | Health data; purpose, necessity, recipients and Article 6/9 grounds require review. | Do not use the real record in this exercise; escalate the specific disclosure. |
| A named list of union subscriptions | Trade-union membership is special-category data. | Do not infer permission from payroll access; assess the particular purpose and legal condition. |
| Face images proposed for identity matching | Biometric processing for unique identification can bring Article 9 into scope. | Assess the actual processing and safeguards; a generic photo label is insufficient. |
| A report about a criminal conviction | Article 10 has separate conditions. | Route for the applicable criminal-offence-data review rather than assuming Article 9 alone resolves it. |

## Review checklist

- [ ] Question the sensitive detail
  Identify whether an invented example or general description achieves the purpose without the personal record.
- [ ] Record both legal layers
  Document the Article 6 basis and applicable Article 9 condition, including relevant national-law requirements.
- [ ] Review the real destination
  Assess role, instructions, transfers, retention, recipient access and the need for a DPIA.

## Included example files

- gdpr-sensitive-ai-input-map.md
- gdpr-sensitive-ai-input-map.csv

## Source references

- EU GDPR: Regulation (EU) 2016/679: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng (2026-09-21)

Use the worksheet within the relevant legal, contractual and technical scope. It is not a certification or a record of an installed-product test.