Use a business description, not a customer record
Describe the type of business, the service and the question you want to explore. Leave out names, phone numbers, identity details, medical histories and confidential contracts. A planning exercise usually does not need a real customer’s information to show the format of a useful answer.
Map the data flow before deployment
Identify what information is collected, where it is sent, who can access it and how long it is retained. Ask providers about their processing arrangements rather than assuming a general AI label answers those questions. The PDPC document cited here addresses AI recommendation and decision systems; it should not be treated as a blanket exemption for every generative AI use.
Review with the responsible people
Involve the business’s data-protection and operational owners before a live workflow handles customer records. Agree what the agent may collect and when it hands over. The lab does not persist briefs or outputs in application storage, but it sends the brief to its configured AI gateway. That processing still deserves a clear explanation.