This study adopts the design science research strategy and systematically progresses through all five phases. It identifies the key risks of data leakage, legal violations, and contextual re-identification. Correspondingly, technical and organizational mitigation measures are collected, including raising employee awareness, on-premises LLMs, and data sanitization.

The central outcome of this thesis is a framework that enables organizations to systematically identify and assess privacy and data security risks when using LLMs. It is designed for professionals with a basic understanding of both LLMs and privacy and data security, but who are not necessarily experts in either field. The framework was evaluated through interviews with potential users. The results confirm that it helps raise awareness, supports structured decision-making, and avoids ineffective actions. With this framework, the thesis contributes to the existing body of knowledge by providing a practical artifact that addresses a current gap in managing privacy and data security risks in the professional use of LLMs.