Harvey

Harvey’s Privacy team is brought into procurement projects that may involve personal information, which means frequent vendor onboarding reviews. Reviewing privacy and security documentation to spot alignment and gaps against internal requirements was repetitive and time-consuming.

The team built a custom Harvey Workflow Builder process for vendor onboarding reviews. Users enter the vendor name, engagement purpose, and personal information types, then upload privacy and security documents; Harvey returns a summary of key terms and a side-by-side mapping of Harvey’s requirements to the vendor’s commitments (incident notification, international transfers, data use, retention, and related obligations), with findings validated against source documents and final decisions remaining human-led.

Creating and fine-tuning the workflow took about an hour. The Privacy team reports the workflow saves at least 4–6 hours every week, and an estimated average of at least 2–3 hours of work per engagement involving personal information.

• • Custom agentic workflows can encode recurring privacy/security review checklists while keeping humans in the loop on final decisions.
• • Grounding every finding in source documents preserves existing security and privacy controls while speeding review.
• • Mandating and operationalizing specific use cases (not just providing tools) is needed for measurable returns.