Data minimisation checklist for analyzing CSVs with AI

Why file analysis becomes a compliance question

If you work with spreadsheets that hold customer emails, order histories, HR records, or survey responses, uploading one to an online tool creates a processing activity: a transfer, a sub-processor, a retention window, and a record you may need to document. That does not make the workflow wrong — it makes it something to do deliberately.

The practical lever is minimisation. Reduce what leaves your machine, shorten how long it is kept, and be able to say precisely which party received what. The checklist below works for any AI tool, and the section after it describes exactly what AskCSV does.

Data minimisation checklist

1. Decide whether the file can leave the machine at all. If it cannot, legally or contractually, use a tool that never sends anything to a model. AskCSV keeps the file in your browser and minimises what it sends, but it still sends the question, the columns you choose to share with a sample, and up to 100 rows of each query result, so check that first.
2. Send the columns you need, not the whole export. Drop direct identifiers (names, emails, phone numbers, national IDs) when the question is about amounts, dates, regions, or categories.
3. Use a sample or synthetic rows for the first pass. Confirming that a tool understands your headers costs nothing if the rows are invented.
4. Check what is transferred. Find out which parts leave your machine and how. With AskCSV the file stays in the browser; the question, the shared columns with a sample, and up to 100 rows of each query result are sent over HTTPS.
5. Name the sub-processor. Identify which AI provider receives your questions, and what part of the file it sees. "The tool is private" is not an answer to this question; "the provider receives the selected column names and types, a sample, and up to 100 rows of each query result" is.
6. Get the retention window in writing. How long does the tool hold the question, the sample you share, and the results?
7. Confirm deletion is real and available to you. Can you delete a single file or chat, and clear everything the tool stored in your browser?
8. Keep an audit trail of the calculation. A visible SQL query or a reproducible result turns "the AI said so" into something a reviewer can check.
9. Write down who approved what. Purpose, lawful basis, data categories, recipients, retention, and the security measures you relied on.
10. Revisit when your data changes. A column added in six months can change the risk of the same workflow.

How AskCSV handles your data

AskCSV applies minimisation by design: the file stays in your browser and every query runs there, columns that look sensitive start turned off, and what goes to the AI is capped by a fixed request format that both your browser and AskCSV's server check — a request over the limits is refused.

Two limits are worth stating rather than hiding: AskCSV analyzes opened files only, with no direct database connection, and the AI's answers can be wrong, which is why the SQL is on screen for every chart.

The privacy policy is the authoritative description of this processing.

What none of this proves

AskCSV does not claim GDPR certification, a compliance badge, or that using it makes your processing lawful. Those depend on your lawful basis, the data you chose to send, your own security measures, your contracts with the people in the data, and your documentation. A tool can reduce the surface; it cannot make the decision for you.

This page is not legal advice. Involve your privacy, security, or legal team before sending personal or regulated data to any online tool.

Questions you can ask once a file is loaded

• "Which regions have the highest churn?"
• "Break down revenue by month and product category."
• "Which customer segments have the most repeat orders?"
• "What's the average delivery time by country?"

Each answer comes with a chart and the SQL behind it, so the result can be checked rather than assumed.

Evaluate it against your own requirements

Start with a synthetic sample, read the privacy policy, and confirm the sub-processor and retention details match what your review requires. If they do not, keep the analysis on your own machine — a defensible no is better than an undocumented yes.