Skip to main content
For each use case identify:
  • the data required;
  • whether personal, sensitive or confidential information is involved;
  • who needs access;
  • where the data will be processed;
  • any retention or client restrictions.
Use only the information needed for the task. For Iris interviews and screen observation, explain how evidence will be used and avoid framing participation as performance surveillance. Involve privacy, security or legal specialists for high-impact decisions, sensitive personal data, regulated contexts, large-scale monitoring or uncertain legal obligations.
This is not legal advice; requirements vary by jurisdiction and use case.