Map the processing
Identify the personal data each service handles, why it is needed and which providers may access it.
Configure for your needs
Set access, retention, backups and incident handling for each deployment. External AI APIs may introduce additional data flows.
Read the Swedish Authority for Privacy Protection’s guidance