Privacy and Data Governance

Purpose and accountable data use

Data governance assigns decision authority, handling rules and evidence obligations across an information lifecycle. Privacy governance addresses effects on people; the broader discipline also covers licensed material, confidential business information and operational records. [1]

Purpose limitation constrains collection and subsequent use to specified purposes under applicable rules. Secondary use introduces another purpose. [2]

Necessity connects each field to a benefit. Proportionality weighs that benefit against effects on people and less intrusive alternatives. A decision can narrow the task or refuse it rather than approve every technically possible use. [8]

Information inventories across processing boundaries

Under the EU GDPR, personal data relates to an identified or identifiable person—the data subject. Identification can be indirect. [2]

The inventory must include inferred attributes, not just submitted fields. Ordinary writing can support predictions about someone’s location or circumstances, creating sensitive information without an explicit identifier. [11]

For each artifact, record its owner, purpose, location, recipients and downstream copies. Inventory relationships as well as storage systems: a protected source can feed a differently governed destination. [1]

Rights, restrictions and decision authority

A lawful basis is an applicable legal ground for processing personal data; consent is not universally required. [2]

Public availability does not settle that assessment. Under the EDPB’s AI-model opinion, reliance on legitimate interests requires an interest, necessity and balancing against affected people’s rights. Development and deployment can have different purposes. [7]

Copyright is an independent restriction. The US Copyright Office’s May 2025 report explains that downloading and preparing training material can implicate reproduction rights. Licensing may authorize specified uses; fair use depends on circumstances. The report is institutional analysis, not a binding judgment granting permission for a particular corpus. [9]

Under the EU trade-secrets directive, a trade secret must be secret, commercially valuable because of secrecy, and reasonably protected. Unauthorized copying, disclosure or use contrary to confidentiality duties can be unlawful. Statutory exceptions apply, including specified public-interest disclosures. Other confidential information may remain contractually restricted without satisfying that definition. Internal approval cannot override applicable restrictions. [20]

Transparency, consent and individual requests

A privacy notice explains handling; access rights concern data and handling information. Under GDPR, additional identity evidence must be necessary to resolve reasonable doubts, not routinely demanded. [21]

When relying on consent, retain the purpose, scope, notice version, when and how agreement was obtained, and withdrawal history. The EDPB consent guidelines require demonstrable validity; a checkbox alone is insufficient. Choice must be meaningful, and withdrawal must be as easy as consent without detriment. [22]

Withdrawal does not retrospectively invalidate previously lawful processing. Another independently established purpose may continue under its own ground; an organization cannot invent a replacement ground to evade withdrawal. Route the change by purpose, identify affected processing, and retain evidence of what stopped. [22]

For an inferred customer attribute, determine what the record asserts. The ICO’s rectification guidance distinguishes factual errors from clearly recorded opinions. Assess the person’s evidence and consequences of use, restrict processing while checking where appropriate, and explain decisions and challenge routes. Calling every prediction an opinion does not resolve accuracy duties. [23]

Minimization and remaining identification risk

Minimization limits collection, use, exposure and duration to the approved purpose. Omission prevents a copy from being created; later filtering must locate and transform information already present. [1]

Redaction removes or masks sensitive content. Detection can return sensitive spans and categories separately from replacement policy, allowing removal, category labels or stable substitutes without conflating extraction with privacy validation. [27]

Pseudonymization separates identifying information under safeguards while retaining possible association. Anonymity requires evidence about identifiability in context, not merely transformed appearance. [2][7]

Hashing predictable identifiers permits candidate guessing. Apply purpose-driven capture before export, as explained in Observability; collecting fewer records does not make retained content harmless. [29]

Generated derivatives require their own anonymity assessment. Local execution changes who operates infrastructure, but leaves the application responsible for classification, permissions and appropriate use. [7][30]

Authorization at access and disclosure boundaries

Authentication establishes identity; authorization determines permitted operations on particular resources. A service account’s credentials may reach more records than the requesting person is entitled to use. [19]

Role-based rules assign permissions through roles. Attribute-based access control evaluates requester, resource, operation and environmental characteristics. An application can express tenant, purpose and recipient constraints through such attributes; their values must be trustworthy and current. [4][6]

Least privilege grants only necessary authority. Complete mediation checks every protected access, including cache reads, exports, tool calls and recovery paths. Cached decisions must account for revocation. When required authority cannot be established, deny the operation. AI Security explains enforcement against attacks; model willingness is never the authorization boundary. [32]

Approval and authoritative record changes

A system of record is the designated authoritative source for a business fact. A data contract records the producer–consumer agreement around that information. Integration into existing work explains why field meanings, identifiers, ownership and support responsibilities matter. [18]

Permission to summarize a customer conversation does not include permission to update contact details. Read, edit, delete and copy are distinct operations. [6]

An HTTP update carrying If-Match: "v1" must not execute when the current strong entity tag differs. This prevents stale writes, not unauthorized or factually incorrect ones. [35]

Keep an AI-inferred attribute distinguishable from a confirmed fact. Correction requires an accountable disposition and a new authorized update; a historical error can remain accurately recorded alongside its correction. [23]

Lineage and proportionate audit evidence

Provenance describes origin and history; lineage records derivation relationships. W3C PROV distinguishes information entities, transforming activities and responsible actors. Participation in one activity does not itself establish derivation. [36]

Dataset versions locate a collection; record-level relationships identify particular contributors. Retrieval-use graphs can reveal which chunks appeared in conversations, but frequent use establishes neither correctness nor permission. Citation links also require preserving the backend path to source facts. [37][38]

Separating orchestration events from versioned sensitive objects lets developers inspect execution without receiving payload access. References and metadata still need privacy review. An immutable event log preserves recorded history; it cannot supply events that were never captured. [41][40]

Restrict and review audit access, protect integrity, sanitize untrusted event fields, and apply disposal rules to extracts and backups. Avoid copying credentials or sensitive payloads for convenience. Capture policy governs which diagnostic information is emitted. [42]

Vendor and model-processing obligations

A data processing agreement documents processing obligations. Under EU controller–processor guidance, a subprocessor is another processor engaged in the chain. Authorization, change notification, audit information and return-or-delete arrangements require explicit handling. Contract terms do not establish fulfillment. [17]

No-training commitments and no-retention commitments answer different questions. Anthropic’s feature-specific retention documentation, checked August 29, 2026, distinguishes storage-dependent features from zero-retention eligibility. It separately describes training permission and hosting relationships. Those distinctions must be checked for the actual product and configuration. [44]

Data residency concerns where information resides; cross-border transfer concerns movement or access across national boundaries. A VPC—an isolated cloud network—does not establish government-cloud or on-premises availability. The managed-RAG deployment discussion illustrates that distinction, not current vendor suitability. [45]

Self-hosting transfers more software, patching and availability work to the operator. Managed services transfer some infrastructure work to providers. Neither arrangement transfers the application’s responsibility for data classification, permissions and appropriate use; location alone cannot settle those obligations. [30]

Retention schedules and restricted preservation

Retention is how long information remains stored or available. A cutoff starts a retention period; disposition is eventual destruction or transfer. NARA’s scheduling guidance provides a useful event-based model, not disposal authority for private applications. [46]

A legal hold is a preservation obligation requiring qualified interpretation. Document its basis, covered records, owner, access restrictions and release conditions. An exception permitting preservation does not automatically permit continued ordinary processing. [24]

For valid erasure requests, UK guidance addresses backups as well as live systems. Copies awaiting scheduled overwrite must remain beyond use, not repurposed. Explain that status to the person; ending active access is different from completed destruction. [24]

Lifecycle fulfillment across derivatives

Stopping a purpose, revoking authority, correcting a fact and deleting a copy are distinct operations. Keep a destination ledger so successful work at one store cannot conceal unfinished work elsewhere. [49]

Azure’s blob deletion policy needs an observable marker and sufficient retention for indexer outages. Its soft-delete policies exclude one-to-many indexing; those derived entries require explicit deletion. [50]

Deletion acknowledgement and search visibility can differ. Elasticsearch exposes a refresh boundary; deleted-version retention is also finite. Delayed ingestion therefore needs durable deletion markers or version checks beyond that window to prevent obsolete records from returning. [47]

Deleting a stored artifact cannot retract an earlier disclosure. Report verified destinations, restricted exceptions and unresolved effects separately; the accountable owner decides the remaining response rather than declaring universal completion. [25]

Assurance and operating changes

A privacy impact assessment examines processing, effects on people, alternatives, mitigations and residual risk—the risk remaining after controls. A DPIA is a jurisdiction-specific data protection impact assessment; the ICO guidance distinguishes legal triggers from wider good practice and calls for reassessment when processing changes. [8]

Changing product context changes the decision. Workday’s described progression from help articles to page-aware assistance introduced compensation information with greater sensitivity. Reusing an assistant interface did not preserve the original data-risk boundary. [53]

When a boundary fails, contain affected processing, preserve necessary restricted evidence, investigate scope and correct the cause. Resume only the paths whose restoration criteria have been verified with their owners. Passing fresh-request checks cannot justify an untested cache or restore path. AI Security covers the broader response discipline. [49]

Open questions

1. 01

   Derivative anonymity remains difficult to establish across changing access conditions. Embedding reconstruction and contextual attribute inference expose different risks; progress requires evaluations covering the actual encoder, accessible representations and plausible auxiliary information, rather than treating a transformation label as evidence. [13][11]

2. 02

   Disputed AI attributes need context-sensitive correction rules. The boundary between factual assertion and recorded opinion changes the response, while either can affect a person. Progress would include documented dispositions tied to what each record asserts and the consequences of its use. [23]

3. 03

   Deletion remains vulnerable to delayed replay. Finite search-engine deletion history can outlive neither every queue nor every restoration source. Progress requires demonstrated rejection of obsolete updates after ordinary deletion metadata expires, with explicit coverage of restoration paths. [47]

4. 04

   Verifying removal of training influence remains an assurance problem distinct from deleting examples. The studied verification methods can be fooled by dishonest providers; extending trustworthy checks to deployed language models requires evidence beyond the image-classification settings already tested. [52]