PII Inventory Builder AI Prompt

Build a structured PII inventory for this system or dataset.

System / dataset: {{system_name}}
Data source description: {{source_description}}
Applicable regulations: {{regulations}} (GDPR, CCPA, HIPAA, etc.)

A PII inventory is the foundation of any privacy program. You cannot protect data you do not know you have.

1. Identify all personal data elements:
   For each data element present in the system, classify it:

   DIRECT IDENTIFIERS (identify a person alone):
   - Full name, first name + last name
   - Government ID numbers (SSN, passport, driver's license, national ID)
   - Financial account numbers (bank account, credit card)
   - Medical record numbers, health plan numbers
   - Email address, phone number, home address
   - Biometric data (fingerprint, facial recognition, voice print)
   - Precise geolocation

   INDIRECT / QUASI-IDENTIFIERS (identify when combined):
   - Date of birth, age, age range
   - Gender, race, ethnicity
   - Job title, employer, department
   - Zip code, city, country
   - IP address, device ID, cookie ID, advertising ID
   - Username, user ID

   SENSITIVE SPECIAL CATEGORIES (require heightened protection under GDPR Art. 9 / similar):
   - Health and medical data
   - Genetic data
   - Sexual orientation or gender identity
   - Religious or philosophical beliefs
   - Political opinions
   - Trade union membership
   - Criminal convictions and offenses

   CHILDREN'S DATA (requires additional protections under COPPA, GDPR Art. 8):
   - Any data about individuals under 13 (COPPA) or under 16 (GDPR)

2. For each identified data element, record:
   - Field name in the system
   - PII category (direct identifier / quasi-identifier / sensitive / children's)
   - Applicable regulation(s)
   - Business purpose for collecting this data
   - Who can access it (roles)
   - Where it is stored (table, system, cloud region)
   - Is it encrypted at rest? In transit?
   - Retention period
   - Is it shared with third parties? Which ones?

3. Re-identification risk assessment:
   - Even if no single field is a direct identifier, can combinations re-identify individuals?
   - Apply the 'motivated intruder' test: could a determined person identify someone using only the data in this system?
   - Flag any combination of 3+ quasi-identifiers as a re-identification risk

4. Gaps and recommendations:
   - Which data elements lack a documented business purpose? (Violates data minimization principle)
   - Which data elements have no defined retention period?
   - Which sensitive categories lack explicit consent documentation?

Return: PII inventory table, sensitive category flags, re-identification risk assessment, and gap list with recommended remediation.