PII Shield
Compliance kit · document 1 of 2
Data Protection Impact Assessment - Employee AI-Usage Monitoring
Complete this DPIA before enabling PII Shield's retrospective leak audit. Systematic monitoring of employees' AI usage is high-risk processing under GDPR Article 35, so a DPIA is mandatory. Fill in each section; keep the signed record and revisit it whenever the processing changes.
1 · Purpose & lawful basis
Guidance - read before completing
Consent is not a valid lawful basis for monitoring employees: the employer–employee power imbalance means consent cannot be freely given. Rely instead on legitimate interests (GDPR Art. 6(1)(f)) supported by the documented balancing test in section 3. State the specific interest - e.g. protecting customers' and employees' personal data from being disclosed to third-party AI tools - not a generic "security" claim.
2 · Description of the processing
What PII Shield does - verify this matches your configuration
PII Shield scans messages and files entering AI tools for personal data (email, cards, phone, SSN, national IDs, IP, IBAN and any custom terms you configure). For each detection it records a leak event, never the conversation text. It stores an opaque placeholder (
•••), the data type, and an HMAC blind index used only for de-duplication and false-positive suppression. Where the value itself is retained, it is encrypted with an RSA public key your workspace generates in its own browser (RSA-OAEP wrapping AES-256-GCM); the private half never leaves that browser, and reveal happens on your device. A workspace with no such key has no value stored at all - the vendor does not fall back to a key it holds. Raw personal data is never stored by the vendor, and the vendor holds no key that can decrypt stored values. The browser extension and CLI plugin encrypt on your device, so the value never reaches the vendor's systems even in transit.| Data element | Stored? | Notes |
|---|---|---|
| Conversation / message text | No | Never captured or stored. |
| Masked placeholder | Yes | Fixed ••• token - never a partial value; safe to display. |
| Encrypted value | Default on | AES-256-GCM, tenant-held key; vendor cannot decrypt. A workspace with no reveal key stores no value at all. |
| Blind index (HMAC) | Optional | De-dupe / "leaked again?" - non-reversible. |
| Seat / actor, timestamp, PII type | Yes | Attribution and trend analysis. |
3 · Necessity & proportionality test
Guidance
Show the monitoring is necessary and the least intrusive method that achieves the purpose (data minimisation). PII Shield's masked-by-default, no-raw-storage design is what keeps this proportionate - lean on it. Weigh your legitimate interest against employees' reasonable expectation of privacy and reach a reasoned conclusion.
4 · Risks to employees & mitigations
| Risk | Mitigation in the product / your controls | Residual risk |
|---|---|---|
| Exposure of raw personal data | Masked-by-default; raw values never sent to vendor; optional storage is tenant-encrypted | |
| Over-broad surveillance / "function creep" | Scope limited to PII detection; no content capture; documented purpose | |
| Unauthorised reveal of a value | Privileged, role-gated reveal that is itself audited | |
| Excessive retention | Short configurable retention; per-tenant + selective delete for erasure | |
| Chilling effect / lack of trust | Transparency notice to staff (see companion document) |
5 · Works-council / consultation checklist
Guidance
Co-determination is mandatory before deploying monitoring-capable tools in several EU states - and the trigger can be mere suitability for surveillance, not intent. Complete the items that apply to where your staff are based. Do not activate monitoring until required steps are done.
Germany - prior works-council agreement obtained (Betriebsvereinbarung).
Netherlands - works-council consent obtained (decisions are invalid without it).
France - prior consultation of the works council (CSE) completed.
Other EU / EEA states - local employee-representation requirements identified and met.
Employee notice prepared and ready to distribute (see companion document).
DPO / privacy lead consulted on this DPIA.
6 · Retention
Guidance
Keep leak events only as long as necessary for the stated purpose. Short retention reduces breach exposure and supports the right to erasure. Record your period and how erasure requests are handled.
7 · Sign-off
By signing, the parties confirm the processing described above has been assessed, the mitigations are in place, and any required consultation is complete before activation.
Data Protection Officer / Privacy lead - name
Signature & date
Accountable owner (controller) - name & role
Signature & date
🔒 Why this design keeps the audit lawful: the vendor never receives or stores raw personal data; values are masked by default, any stored value is encrypted with your key, reveals are privileged and audited, and retention is short. That data-minimisation is the core of the necessity and proportionality case above.