Review Data Privacy / GDPR

Data privacy is the lawful, fair, transparent, and controlled handling of information about people. The GDPR — the European Union's General Data Protection Regulation — is the law that sets out specific rights for individuals and specific obligations for organizations that process personal data within its scope, including organizations based outside the EU that handle the data of people in it.

AI systems may collect, receive, infer, store, transform, or expose personal information. Privacy work asks whether that processing has a valid purpose and basis, uses appropriate limits and safeguards, and respects applicable rights.

Data can cross vendors, models, logs, retrieval stores, and outputs. Organizations need current legal and operational analysis before using personal data in an AI workflow.

Before connecting customer records to an AI assistant, a company evaluates purpose, legal basis, minimization, access, retention, vendors, transfers, security, and individual rights.

Removing names does not automatically remove personal-data obligations, and GDPR is not the only privacy law that may apply.

Personal data carries duties through every AI handoff.

* [[sensitive-information|Sensitive Information]] * [[sanitized-information|Sanitized Information]] * [[data-leakage|Data Leakage]] * [[de-identification-anonymization-risk|De-Identification and Anonymization Risk]] * [[data-provenance|Data Provenance]]

* [European Union, General Data Protection Regulation](https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=en) — official legal text governing personal-data processing in the European Union. * [NIST Privacy Framework](https://www.nist.gov/privacy-framework) — risk-based guidance for identifying and managing privacy risk.

* Consult current official GDPR and applicable privacy-regulator guidance; begin operationally with [[sensitive-information|Sensitive Information]].