AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Operational and Technical
Control requirement
Build data protection into AI design and default configuration, limiting information, access, persistence and disclosure to what the approved purpose needs. Require deliberate authorization for higher-exposure options.
Why this matters
Privacy settings added after deployment may not address copies and permissions already embedded in the architecture. Protective defaults reduce exposure before users make choices or operators remember to change a setting.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI design, procurement, configuration and release, including hosted features, retrieval connectors, telemetry and tool integrations.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The system owner is accountable; engineering implements defaults with data, privacy and security review.
Implementation guidance
- Define the minimum data, audience, access and retention needed for the intended purpose before choosing integrations.
- Select architecture and configuration that reduce unnecessary collection, persistent content, cross-user retrieval and secondary supplier use.
- Require explicit reviewed enablement of broader access, longer retention or optional data sharing, recording the relevant authority.
- Test fresh deployments and upgrades to confirm protective defaults persist and document constraints that require additional controls.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Create a fresh deployment | Its default access and collection match approved minimum requirements. |
| Enable a higher-exposure feature | Authorization and affected data review occur before use. |
| Upgrade the application | Protective defaults and restrictions do not silently reset. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Design and minimization decisions
- Approved default configuration
- Feature enablement records
- Fresh-deployment and upgrade tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unsafe defaults or material exposure introduced by upgrades to system and privacy owners. Disable affected options and assess information already collected or disclosed.
Example in practice
Hypothetical example: A recording assistant defaults to temporary processing without provider training use. Longer retention and wider sharing require separate approval rather than being enabled for every new workspace.
Related controls
- CF05-007: AI Data Protection Impact Assessment (DPIA)
- CF05-010: AI Data Purpose Limitation
- CF12-004: AI Knowledge Base & RAG Access Control
Framework mappings
- CSA AICM (DSP-07, DSP-08)
- NIST AI RMF (MAP 1.1)
- EU AI Act (Art. 10(5), GDPR Art. 25)
- ISO 42001 (Cl. 8.2, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0