Data, privacy and AI

Start with a map

Before any rules, answer five plain questions about each AI system: What personal data goes in? Where did it come from? Why do we need it? Who can see the outputs? How long do we keep it? If you cannot answer, that is the first risk. The data lineage mapper records the answers and flags gaps such as unknown licences or personal data with no recorded basis.

The main ideas

• Lawful basis. Data protection laws generally require a legal reason to use personal data, such as consent or a legitimate interest. Record the reason for training data and for live use.
• Purpose limits. Data collected for one purpose should not quietly be reused for another, including training a model.
• Minimization. Use the least personal data that does the job. Remove identifiers if you can.
• Retention. Set how long data, prompts, logs and outputs are kept, and delete on schedule.
• Transparency and rights. People may have rights to be told how their data is used, to access it and to challenge some automated decisions.
• Security. Protect data in training pipelines, in storage and in model access.

Cases that need extra care

• Sensitive data and children’s data. Health, biometric and similar data, and anything about children, usually carry stricter rules.
• Training on customer data. If a vendor trains on your data, or you train on your customers’ data, check contracts, notices and legal basis first.
• Staff pasting data into tools. The most common leak is a person putting client or personal data into an unapproved tool. Clear rules and approved tools prevent most of it.
• Cross-border transfers. Vendors may process data in places you have not assessed.
• Automated decisions. Rules on solely automated decisions with significant effects exist in several regions; the UK’s reformed rules allow them with safeguards such as information, human review and a way to contest.

Region pointers (summaries)

In the EU, the GDPR applies, including data protection impact assessments for high-risk processing and limits on solely automated decisions (Article 22). In the UK, UK GDPR and the Data (Use and Access) Act 2025 apply; the ICO publishes AI guidance. In India, the DPDP Act and Rules apply in phases, with notice, consent, security and breach duties, and extra duties for Significant Data Fiduciaries. In the US there is no single federal privacy law; sector and state privacy laws apply, and some state laws require notices and risk assessments for automated decisions. See each region page for dates and sources.

A privacy check you can run in an hour

1. List the personal data used by the system and mark each item as needed or not.
2. Write down the lawful basis or consent for each use.
3. Check the retention period for data, logs and outputs.
4. Check where vendors store and process the data.
5. Decide whether an impact assessment is needed, and if so use the impact assessment builder.

Example

A support team uses a chatbot trained on past tickets. The tickets contain names, addresses and sometimes health details. The team had never recorded a lawful basis, and the vendor kept chat logs indefinitely. After mapping the data, they removed identifiers before training, cut log retention to 90 days, and added a notice to the chat. The model worked as well; the risk dropped sharply.

What to do now

• Map the data for one system with the lineage mapper.
• Add a line to your AI use policy about which data may go into which tools.
• If a system makes or shapes decisions about people, start an impact assessment.