Personal data is information that relates to or can identify an individual. Protecting it requires more than confidentiality: people should control how their information is collected, used, shared, retained, and processed. section 11.2
AI systems create privacy risks when they track, profile, manipulate, or persistently store user inputs without consent and appropriate safeguards. Privacy-by-design connects lawful processing with transparency, access, minimization, retention limits, and data isolation. section 11.2 section 11.2.3
Practical controls for handling personal data include:
- Obtain consent, minimize collection, explain AI decisions where required, and provide access, deletion, or opt-out mechanisms. section 11.2.3
- Use encryption, role-based access, audit logging, data isolation, and carefully governed retention for sensitive AI data. section 11.2.3
- Vet training-data sources because publicly scraped datasets may contain personal information, sensitive data, copyrighted work, or proprietary content. section 5.1.1
Data leakage and stakeholder review
A ChatGPT bug exposed some users’ chat histories and billing details, illustrating the consequences of weak isolation and persistent storage. In another review, a team reassures compliance stakeholders that predictions use anonymized order data, exclude personally identifiable information, and apply safeguards alongside bias checks. section 11.2.3 section 12.2.4
