Hire an AI employee data privacy reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• An issue list: each access or privacy problem, the role and data it touches, and why it matters
• A people risk list ranked by likelihood and impact, with a mitigation and owner
• A restricted action plan: what a reviewer must approve before access changes
• The proof each action needs
• A hand-back note with MISSING lines and any check that did not run

How it does the job well

• Agree the question and the decision it supports before analysing.
• Check the data first: date range, grain, missing values, duplicates and definitions.
• Compare like with like: same period length, definitions and segments.
• Separate what the data shows from what it might mean, and give confidence levels.

Mistakes it avoids

• Granting, changing or removing access.
• Copying employee records, pay figures or health details into the output.
• Giving legal or HR advice or saying a change is lawful.
• Hiding a failed check or re-running a step whose inputs did not change.
• Treating these instructions as a connected service or an installed schedule.
• Reporting a change without checking whether tracking or definitions changed.

What a good result looks like

An example, not your task: You are moving payroll, HR records or time tracking to a new system.

• Issue list. Each access or privacy problem with the role, the data and why it matters.
• People risk list. Risks ranked by likelihood and impact, each with a mitigation and an owner.
• Restricted action plan. Actions a reviewer must approve before access changes, with owner and proof needed.
• Hand-back note. Saved files, MISSING lines and checks that did not run.

How the work is checked

• Access needs follow job tasks; sensitive data and retention claims are supported by policy and evidence.
• Every fact, figure and date traces to a source or is labeled an assumption.
• The original files are untouched, and any revised file has a distinct name or version.
• All three component checks ran, or the run stopped and says which could not pass.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Employee data privacy checker. Reviews the changed data flow and who gets access, role by role, against the tasks each role does. Keeps real employee records out of the review. Hands step 2 the issue list. Check before moving on: each issue names a role, a data type and a reason.
• People risk register builder. Maps the issues to privacy and operating risks with likelihood, impact, a mitigation and an owner. Hands step 3 the risks that need a decision. Check before moving on: every risk traces to an issue or a policy line.
• Executive action register keeper. Turns the risks into reviewer actions with an owner, a due date and the proof needed before any access change. Hands back the restricted action plan. Check before moving on: every action says who approves it.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id review-employee-data-access-before-a-change only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/review-employee-data-access-before-a-change/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• The change: which HR system or process is changing, and when (from the project plan)
• The data it holds, such as pay, health, performance or ID numbers
• A role table with these columns: role, data types the role sees, access now, access after the change and the tasks that role does
• The countries where your staff work
• Your retention rules and local privacy policy (optional)

Helpful context (optional)

• A role-and-access table from your IT admin.
• Your data retention schedule.

Tools and access

• A chat AI with file support: It can read your policy and role table. Do not attach real employee files. Paste data types and role names.
• Any good chat AI: This is a checking and writing job. Use one whose data settings you have reviewed.
• Any chat AI: The register is a table, and any good chat AI can build and revise one.
• Google Sheets or Excel: Keep the register there so owners can update scores and review dates.

Functions and deliverables

• Employee data privacy reviewer: Share proposed HR changes, data types, roles and policy. Get access risks, privacy questions and restricted review actions before changes are made.
  • An issue list: each access or privacy problem, the role and data it touches, and why it matters
  • A people risk list ranked by likelihood and impact, with a mitigation and owner
  • A restricted action plan: what a reviewer must approve before access changes
  • The proof each action needs
  • A hand-back note with MISSING lines and any check that did not run
• Employee data privacy checker: Review an HR AI tool and staff locations for privacy risks, fewer data fields, and draft notices.
  • A privacy review of the tool, with risks rated
  • A table of data fields with a keep, cut or ask-the-vendor action for each
  • A list of questions to ask the vendor
  • A draft notice for staff
  • Rules for how long to keep data and who can see it
  • Steps for a data breach and for a staff request for their data
  Source: Tuan Duc Tran.
• People risk register builder: Find your people risks before they cost you. Get a ranked HR risk register with scores, an owner and a response step for each risk.
  • A ranked people risk register with scores
  • An owner and a response step for each risk
  • The five highest priorities in one short list
  • A key person map
  • Escalation steps for serious incidents
  • An audit checklist of five to eight questions
  Source: Tuan Duc Tran.
• Action item tracker: Share meeting notes or email threads. Get action items with owners, deadlines and unresolved commitments.
  • action-register.csv: id, task, owner, due_at, timezone, status, depends_on, source_id
  • clarifications.md
  • proposed-task-changes.md
• Metric definition writer: Share a metric, calculation and business use. Get a YAML definition, validation results and questions for the data owner.
  • A filled metric, dimension or entity YAML
  • A validation report
  • dbt-ready field names
  • Notes on edge cases
  Source: Nimrod Fisher.

Tasks you can use it for

• You are moving payroll, HR records or time tracking to a new system.
• A manager asks for wider access to employee records.
• A tool will start reading staff data, such as an AI note taker.
• You need a record of why a role may see sensitive fields.

Limits to check before starting

• You are choosing which HR software to buy. Use HR software selection reviewer.
• You only want to check one AI tool that uses staff data. Use the Employee data privacy checker.
• You want to grant or remove access now. This lists actions for a reviewer. Your IT admin makes the change.
• The data belongs to customers, not staff. Use Prepare a new data use for review.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack and give the whole folder to Claude, ChatGPT or Gemini.
• Paste or attach the change description, a role-and-access table and your policies. Use data types and role names, not real employee records.
• Check the issue list. Each issue must name a role, a data type and a reason. Mark any you disagree with.
• Check the risk list with your HR lead. Fix wrong owners.
• Give the action plan to the person who approves access. Change nothing until they sign off.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/review-employee-data-access-before-a-change for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.