{"slug":"privacy-and-data-protection-for-ai","id":"AIPT-CTL-0019","title":"Privacy and data-protection controls for AI","kind":"process","kind_label":"Process","purpose":"Ensures that personal data used to train, tune or run an AI system is processed on a documented lawful basis, with the assessments, notices, security and individual rights that data-protection law requires.\n","description":"The privacy function maps every AI data flow to a legal basis or recognised exception and records the conditions relied on, such as consent wording, the scope of a business-improvement or research exception, or a legitimate-interest balancing. Where the processing is high-risk, a data protection impact assessment is completed before it starts and merged with the wider AI impact assessment where possible. Privacy notices are updated to describe AI uses, minimisation and retention rules are applied to training and inference data, and rights requests and breach handling are extended to cover model outputs that could reveal personal data. Where a regime designates the organisation for enhanced duties, the officer, auditor and periodic assessment requirements are scheduled.\n","owner_role":"Data protection officer","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["2.1","1.1","4.1"],"evidence":[{"type":"data_protection_assessment","title":"Data protection impact assessment for an AI system","description":null},{"type":"register_entry","title":"AI data-flow and legal-basis record","description":"Each dataset or inference flow with its purpose, legal basis or exception and the conditions met."},{"type":"disclosure_notice","title":"Privacy notice section on AI use","description":null},{"type":"audit_report","title":"Independent data audit or DPO review","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Annex A.7.2, A.7.3; Clause 6.1.4","note":null,"confidence_level":"medium"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MEASURE 2.10; MAP 4.1; GOVERN 1.1","note":null,"confidence_level":"medium"},{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A 5.34 Privacy and protection of PII","note":null,"confidence_level":"medium"},{"framework":"owasp_llm_top10","framework_name":"OWASP Top 10 for LLM Applications","reference":"LLM02 Sensitive Information Disclosure","note":null,"confidence_level":"medium"}],"obligations":[{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","relationship":"supports","note":"Reuse of the DPIA workflow and findings.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","relationship":"satisfies","note":"DPIA built on the provider's documentation.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","relationship":"supports","note":"Lawful basis and safeguards for biometric data.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"india-dpdp-significant-data-fiduciary-duties","title":"Significant Data Fiduciaries must appoint a DPO and run impact assessments and audits","relationship":"satisfies","note":"Schedules the DPO, independent audit and periodic DPIA duties.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-significant-data-fiduciary-duties"},{"slug":"nepal-privacy-act-consent-and-purpose","title":"Collect and use personal information only with consent and for the stated purpose","relationship":"satisfies","note":"Consent and purpose documentation for Nepal personal data.","confidence_level":"high","is_binding":true,"policy":"nepal-individual-privacy-act","jurisdiction":"nepal","url":"https://aipolicytracker.org/obligations/nepal-privacy-act-consent-and-purpose"},{"slug":"uk-ico-dpia-for-ai","title":"Carry out a data protection impact assessment for high-risk AI processing","relationship":"satisfies","note":"DPIA with AI-specific sections before processing starts.","confidence_level":"high","is_binding":true,"policy":"uk-ico-ai-data-protection-guidance","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-ico-dpia-for-ai"},{"slug":"india-dpdp-security-and-breach-notification","title":"Implement reasonable security safeguards and notify breaches","relationship":"supports","note":"Breach handling extended to model outputs and training data.","confidence_level":"medium","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification"},{"slug":"india-dpdp-consent-and-notice","title":"Process personal data only with valid consent or a legitimate use, after notice","relationship":"satisfies","note":"Legal basis and notice recorded for each training and inference data source.","confidence_level":"high","is_binding":true,"policy":"india-dpdp-act","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-dpdp-consent-and-notice"},{"slug":"singapore-pdpc-ai-notification","title":"Notify individuals about the use of personal data in AI recommendations and decisions","relationship":"supports","note":"Privacy notice content on AI data use.","confidence_level":"high","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-ai-notification"},{"slug":"singapore-pdpc-consent-or-exception-for-ai-data","title":"Identify consent or an applicable PDPA exception before using personal data in AI","relationship":"satisfies","note":"Maps each AI data use to consent or a named exception and records the conditions.","confidence_level":"high","is_binding":true,"policy":"singapore-pdpc-ai-advisory-guidelines","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-pdpc-consent-or-exception-for-ai-data"},{"slug":"uae-pdpl-impact-assessment-new-technologies","title":"Conduct a data protection impact assessment for high-risk processing using new technologies","relationship":"satisfies","note":"DPIA before high-risk processing with new technologies.","confidence_level":"high","is_binding":true,"policy":"uae-personal-data-protection-law","jurisdiction":"uae","url":"https://aipolicytracker.org/obligations/uae-pdpl-impact-assessment-new-technologies"},{"slug":"us-new-york-city-local-law-144-data-policy-disclosure","title":"Employers and employment agencies must disclose the data collected and their retention policy for the tool","relationship":"satisfies","note":"Data notice with types, sources and retention.","confidence_level":"high","is_binding":true,"policy":"us-new-york-city-local-law-144-automated-employment-decision-tools","jurisdiction":"us-new-york","url":"https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure"},{"slug":"us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition","title":"Governmental entities must not use AI for biometric identification from public data without consent where it infringes rights","relationship":"supports","note":"Consent and lawful basis for biometric data.","confidence_level":"high","is_binding":true,"policy":"us-texas-responsible-ai-governance-act-traiga","jurisdiction":"us-texas","url":"https://aipolicytracker.org/obligations/us-texas-responsible-ai-governance-act-traiga-government-biometric-identification-prohibition"}],"related_controls":["ai-impact-assessment","data-governance-and-dataset-documentation","ai-interaction-and-use-disclosure","ai-incident-management-and-reporting"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:23+00:00","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai","context_url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai.md"}