∞Direct answer
Direct answer
Use AI to find a lead. Do not use it to pick who gets a call. Say why you use data, who sees it, and how a person checks it. Use data only when you can say why. Let a trained person change or stop a result. A match does not show fit, consent, or a good deal.
Set a small matching job
Write the job first. AI can sort leads by facts in your plan. It must not rule out a founder or send a profile alone.
List the data, who can see it, and the next step. Keep firm facts apart from facts about people. A public firm page may hold personal data.
The ICO says you must name each use and legal basis before AI work starts. Write down that choice. Put the use and basis in your privacy note. [1]
- Job: find leads for human review.
- Use: the exact matching job.
- Data: named fields and approved sources.
- Stop rule: pause when the use or source is unclear.
Give a real choice for consent
Consent is one legal basis. It is not a label for all data use. The right basis depends on the job, the link with the person, and the place. Ask a privacy expert about your case.
When consent is your basis, use plain words. Say why you match and name each extra use. The ICO says consent must be free, clear, and for a set use. It must come from a clear act. [2]
Before you share a profile, say who may get it and why. Make it as easy to take consent back as to give it. Do not hide an extra share in a broad box. [2]
- Say what data you will use.
- Say why the match needs it.
- Name each extra sharing choice.
- Show how to change or take back the choice.
Use less data and check its source
Make a small data map. Say if each field came from a founder, investor, public page, or approved file. Add the date and allowed use.
Do not put all notes into a matching tool. Use only fields needed for the stated job. GDPR says personal data must fit the job and be no more than is needed. [5]
Do not ask a tool to guess health, politics, faith, or other sensitive facts from a profile. A public post is not a pass for a new use. Raise unclear data before use.
- Keep: stage, sector, place, and needed thesis facts.
- Check: source, date, use, and access list.
- Remove: fields that do not help the match.
- Raise: sensitive, disputed, or unclear data.
Make human review a real control
A reviewer should read the matched facts, links, gaps, and any conflict. They must be able to edit, reject, pause, or change the result. A final click is not enough.
Rules can be stricter when AI alone makes a choice with a big effect. The ICO says people then need a way to get human help, give their view, and challenge the choice. The reviewer must be able to change it. [3]
Keep a short record of the data, result, reviewer, change, and reason. NIST has a voluntary guide for managing AI risk in design, use, and checks. [4]
- Reviewer: a named person with power.
- Proof: facts, links, dates, and gaps.
- Change: what changed and why.
- Review date: when the use and rules will be checked.
FAQ
Frequently asked questions
Can AI pick which founder we contact?
AI can sort leads. A person should choose whether to make contact after checking facts, source, and context. A rank does not show fit or consent.
Do we need consent for each profile?
Not always. Consent is one legal basis. The ICO says you must pick and record the basis that fits each use before work starts. [1] If you use consent, it must meet the consent test. [2]
What should a matching note say?
Say what data you use, why you use it, who sees the result, and how to ask a question. List each extra share on its own. Use clear words.
Can human review be a final click?
No. A good review checks the facts and can change the result. For some AI-only choices, the ICO says the reviewer needs power and skill to change the choice. [3]
How long should we keep matching data?
Set a short check date. Delete data when the stated use ends unless you have another valid need. GDPR says do not keep personal data longer than needed. [5]
REF
Sources
- 1
Information Commissioner's Office
How do we ensure lawfulness in AI? ↗ - 2
Information Commissioner's Office
What is valid consent? ↗ - 3
Information Commissioner's Office
How do we ensure individual rights in our AI systems? ↗ - 4
National Institute of Standards and Technology
AI Risk Management Framework ↗ - 5