THINK FIRST·CODE LATER

← All labs
S11.5 Review Chapter 11

Privacy impact assessment for Buddy

Problem

Before Buddy is launched, the university's data-protection officer asks for a privacy impact assessment. Write it (about 1.5 pages) with these sections:

  1. Description of the processing — what data, whose, sources, flows (including to the AI provider), storage locations, retention.
  2. Necessity and proportionality — purposes, legal basis/consent, why each data item is needed, what was minimized.
  3. Risks to students — at least six, each with likelihood and severity (low/medium/high).
  4. Measures — technical and organizational measures per risk, and the residual risk.
  5. Cross-border check — what changes if the AI provider processes data outside mainland China.
  6. Conclusion — launch / launch with conditions / do not launch, and what will be reviewed after three months.

Work it out on paper, in a document or here, then compare with the model answer. Your answer stays in your browser — it is never sent to or stored on the server.

← S11.4 Privacy-safe statistics for instructors S11.6 Design the privacy controls: consent, rights and deletion →