Clarify data protection before the project starts

Project preparation and the website privacy policy serve different purposes

This website’s privacy policy describes data handling when you visit enaudo.de and use the services listed there. It does not automatically govern how a custom business solution processes your customer, employee or job data.

A project therefore needs separate clarification of its actual data flows, the tasks of those involved and the required contractual arrangements. The following points support that preparation. They are not legal advice, certification or a blanket assurance of GDPR or AI Act compliance.

• Website privacy policy

  The legal information about visiting this website, the contact form and its other services.

• Project process

  When requirements, scope, review and operational responsibilities are agreed together.

Which data does the process actually need?

• Purpose: what specific work outcome should the processing enable?
• Scope: which documents and fields are necessary, and which can be left out?
• People concerned: does the data relate to customers, employees, contacts or other people?
• Special requirements: do documents contain sensitive information or carry particular confidentiality obligations?
• Data flow: where is data created, where is it transferred and which system holds the authoritative version?
• Test data: can development and initial checks use synthetic or anonymised examples?

Even a simple overview of the applications and required fields can help identify unnecessary copies and unclear handovers. If the scope later expands, the data assessment must also cover the new function.

Who is responsible for what?

Before implementation, clarify who decides the purposes and means of processing, which tasks enaudo takes on and which other providers are involved. This determines which agreements, instructions and evidence need to be considered for the assignment. Your data protection specialists or legal advisers should assess unresolved legal questions.

• Identify contacts for business approvals, data protection and technical operation.
• Assess whether a data processing agreement is required and what it needs to cover.
• Record the scope, responsibilities and permitted processing in the relevant agreement.
• List subprocessors and external services, including their specific tasks.
• Agree how changes, security incidents and required information requests will be handled.

Assess hosting and EU processing for the actual services

An EU location is one selection criterion for the planned environment. Before making a commitment, the services actually used and their terms need to be examined. This includes the application, database, file storage, backups and external interfaces. One EU server does not answer every question about the complete data flow.

• Where is data processed and stored, including logs and backups?
• Which providers and subprocessors receive data or have technical access?
• Are there support access arrangements or transfers outside the intended region?
• Which settings, agreements and evidence support the selected processing arrangement?
• Who operates the environment and who is responsible for updates, monitoring and recovery?

The selected environment and its requirements belong in the project decision and the appropriate agreements. This information page does not promise a particular provider or set of contracts.

Access, credentials and traceable changes

For each system, determine which people and technical connections need which permissions. It is equally important to decide who grants those permissions, reviews them regularly and revokes them when responsibilities change or the project ends.

• Limit access to the cases and functions needed.
• Consider personal accounts and technical connections separately.
• Define an appropriate method for providing and storing credentials.
• Decide which editing and approval steps should be logged.
• Clarify who can read logs and how long they are needed.

Please do not send passwords, API keys or confidential original documents in an initial enquiry. If the project requires data or access, an appropriate method will be agreed.

Additional questions when AI is involved

AI is one possible component, for example for assigning document content to fields. Its specific task must be defined before use. We can then assess which data a model would need and whether a simpler method already meets the requirement.

• Which inputs go to which model provider and through which service?
• Where does processing take place and which storage or logging terms apply?
• How is any use of inputs for training or other provider purposes governed?
• Which data can be removed beforehand or replaced with less sensitive details?
• Who reviews the output and stops incorrect or uncertain results?
• Which additional requirements do your responsible specialists need to assess for this use case?

AI output can be factually wrong. The intended checks and approvals therefore need to be defined for binding documents, communication and changes. Choosing a model alone does not resolve the business or legal questions of the overall process.

Agree retention, backups and project closure in advance

• Define retention periods for original files, working copies, results and logs.
• Assess which business or legal retention obligations need to be considered.
• Clarify backup scope, location, access and the recovery procedure.
• Describe how deletion requests interact with backups and their retention cycles.
• Agree data export, handover, removal of access and deletion at project closure.

A backup is another copy of data with its own access and retention questions. Deletion in the application and expiry of backups therefore need to be considered together. The evidence and timescales required are defined for the specific solution.

What to bring to the first discussion

A list of your applications, a description of the process, the data categories needed and existing internal requirements are helpful. An anonymised sample can make the business discussion easier. Unresolved questions are collected before real data and access are provided for implementation.

• Discuss your project

  Start with a short description of your plans and put the open questions into context.

• Document automation

  How extraction, human review and controlled output can work together.

Frequently asked questions