AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Operational
Control requirement
Establish an approved data security and privacy policy for AI covering permitted collection, access, training, retrieval, inference, sharing, retention and disposal. Translate requirements into owned operating procedures and enforceable system settings.
Why this matters
AI can create new copies and uses of information through prompts, logs, embeddings and generated outputs. A general security policy may not tell staff or engineers which of those activities are permitted.
How the control types work together
Operational controls establish the assigned responsibilities, review processes and response decisions described here. Their effectiveness depends on performing the work and using evidence to guide action, rather than approving a document alone.
When it applies
Organizational AI and its supporting data pipelines, hosted services, internal models, agents and employee tools.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data governance owner maintains the policy with privacy, security and AI program leaders; business data owners implement its requirements.
Implementation guidance
- Define covered data, AI uses and lifecycle stages, including derived information and supplier processing.
- Set handling requirements by sensitivity and purpose, including prohibited inputs, authorization, minimum collection and approved destinations.
- Assign decisions, implementation duties, incident escalation and exception authority; align internal rules with applicable external obligations.
- Integrate the policy into procurement, development, training and operational reviews, testing whether teams can apply it to actual workflows.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a sensitive-data AI use | The approved purpose and handling requirements determine its configuration. |
| Present a new employee-use scenario | The policy supplies an actionable approval or restriction path. |
| Inspect a changed supplier processing feature | Required data review occurs before sensitive use expands. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Approved policy and procedures
- Data handling and use criteria
- Training and approval records
- Policy and implementation reviews
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unapproved handling or unclear accountability to privacy, security and data owners. Restrict affected collection or transfers while permitted conditions are established.
Example in practice
Hypothetical example: A meeting assistant offers optional training on transcripts. The policy requires a separate decision on that secondary use instead of allowing recording approval to imply training approval.
Related controls
- CF05-002: AI Data Inventory
- CF05-005: AI Data Ownership & Stewardship
- CF05-010: AI Data Purpose Limitation
Framework mappings
- CSA AICM (DSP-01)
- NIST AI RMF (GOVERN 1.1)
- EU AI Act (Art. 10, Art. 13)
- ISO 42001 (Cl. 5.2, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0