Artificial Intelligence Policy Tracker
Search
Menu

Privacy and personal-data protection: AI obligations

Practical requirements extracted from policy instruments, with the source article, the actors they bind, evidence examples and original framework mappings. Legal requirements are marked; everything else is voluntary guidance.

Results

5 of 117 obligations match · Download these as CSV

Legal requirement Privacy and personal-data protection Nepal

Collect and use personal information only with consent and for the stated purpose

Nepal Privacy Act 2075 · Chapter on collection and protection of personal information (reviewer to cite sections)

Personal information may be collected only by authorised persons for a lawful purpose with the individual's consent, and must not be used or disclosed for other purposes without consent, subject to statutory exceptions. AI systems trained on or processing personal data of people in Nepal must respect these limits.

Pending review (a factual check against the official source, not a legal review)
Legal requirement Privacy and personal-data protection European Union

Deployers must use the provider's transparency information in their data protection impact assessment

EU AI Act · Article 26(9)

Where a deployer of a high-risk AI system is required to carry out a data protection impact assessment under Article 35 of the GDPR or Article 27 of the Law Enforcement Directive, it must draw on the information the provider supplied under Article 13, such as the intended purpose, performance, limitations and human-oversight measures, when producing that assessment.

Verified (a factual check against the official source, not a legal review) Applies from 2 Dec 2027
Legal requirement Privacy and personal-data protection New York (United States)

Employers and employment agencies must disclose the data collected and their retention policy for the tool

NYC Local Law 144 (automated employment decision tools) · NYC Administrative Code Section 20-871(b)(3); 6 RCNY Section 5-303

Unless already disclosed on the website, an employer or employment agency must provide, within 30 days of a written request from a candidate or employee, information about the type of data the automated employment decision tool collects, the source of that data, and the employer's or agency's data retention policy. The DCWP rules allow this information to be posted publicly instead of answered case by case.

Verified (a factual check against the official source, not a legal review) Applies from 5 Jul 2023
Legal requirement Privacy and personal-data protection Singapore

Identify consent or an applicable PDPA exception before using personal data in AI

PDPC AI advisory guidelines · Advisory guidelines, sections on consent, business improvement and research exceptions

Personal data used to train or operate AI systems requires consent unless an exception applies, such as the business improvement exception for improving products and services or the research exception for developing models, each subject to conditions.

Source-linked (a factual check against the official source, not a legal review)
Legal requirement Privacy and personal-data protection India

Process personal data only with valid consent or a legitimate use, after notice

India DPDP Act · Sections 4 to 7

Personal data may be processed only for a lawful purpose with the individual's free, specific, informed and unambiguous consent, or for certain legitimate uses listed in the Act. A notice must describe the data, purpose, and how to exercise rights and complain.

Source-linked (a factual check against the official source, not a legal review)

Frequently asked questions

What is an obligation on this site?

A single practical requirement pulled out of an instrument and stated on its own: keep a risk management system, log incidents, document training data, provide human oversight, and so on. Each one cites the article or section it comes from so you can check it against the source.

Does a voluntary obligation have legal force?

No, and every obligation is labelled either a legal requirement or voluntary guidance. Voluntary items still matter in practice, because procurement questionnaires and auditors ask about them, but only the binding ones carry legal consequence.

How do I find the obligations that apply to my organisation?

Filter by jurisdiction, category, actor, sector or use case. The applicability check asks a short set of questions and returns the duties that may reach you. It is an educational screen, not a legal determination, and it says so.

Why do some instruments have no obligations listed?

Because nobody has broken them out yet. Most instruments are recorded at summary level first; obligations are added jurisdiction by jurisdiction. The coverage and open-gaps pages publish exactly what is missing rather than hiding it.