This page lists three turns, the messages you send to the AI one after another in the same chat, and then a check of the answer. Keep it open next to your chat. Each turn shows the next thing to paste, with the values you entered already filled in. Nothing is sent from this page, and your conversation stays in the AI tool you are using.
Industry, size, revenue, where you operate, and your role in each processing activity.
Be blunt: notice version, request workflow, vendor terms, transfer paperwork, who owns privacy.
Which regimes the analysis has to cover.
Where the company is established, which authority is likely lead, and where your data subjects actually are.
Changes the risk-assessment, consent, and opt-out analysis substantially.
Watch for these throughout
Privacy law and enforcement priorities change faster than any model's training. Treat every article number, deadline, fine figure, and enforcement example as a lead to verify against the current text, not as authority.
Cookie and tracking-technology consent is enforced under member-state rules that sit alongside GDPR, and it is one of the most active areas. Assess it separately or you will miss the thing most likely to generate a complaint.
Cross-border transfer paperwork is where programs quietly fail. Unknown SCC vintage and missing transfer assessments are findings a caseworker can confirm in an afternoon.
A scorecard with a missed request deadline in it is an admission. Think about privilege and framing before this document circulates outside legal, and about who receives it.
The model will score topics you never described. Any GREEN that does not trace to something you actually said should be treated as UNKNOWN until you check it.