During this workshop a fictional scenario triggers the participants' ability to deal with data protection in practice. The case revolves around the modernization need of a healthcare facility in order to develop an AI tool for prediction, diagnosis and treatment recommendations for cancer patients. Participants will delve into the different roles according to GDPR and be challenged by the interplay and application of the GDPR and other EU legal frameworks, such as the AI Act, MDR. In this fictional scenario, an external data protection officer is asked to secure that the tender’s requirements for the AI model to be procured are considered a privacy-by-design product. After a successful award, development and deployment of the AI tool, a patient submits a complaint to the Data Protection Authority because of the hospital’s alleged failure to erase (personal) data from the AI model.