AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Governance and Operational
Control requirement
Assess privacy risks from AI processing through a documented impact assessment proportionate to the use. Determine applicable assessment duties, evaluate necessity and effects on people, and resolve required conditions before processing begins.
Why this matters
A technically secure service may still collect unnecessary information or create harmful inferences. Privacy assessment examines whether and how processing should occur, not just whether the storage is encrypted.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
New or materially changed personal-data AI processing; qualified reviewers determine when a formal DPIA or other external assessment requirement applies.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The accountable processing owner leads with privacy expertise and relevant technical, legal and stakeholder input.
Implementation guidance
- Screen the proposed processing and applicable duties, recording the rationale and any required review or consultation route.
- Describe purpose, data flows, roles, necessity, alternatives and effects on people, including inferred information and downstream use.
- Assess risks, mitigations and residual exposure, documenting limits and assigning implementation owners.
- Approve processing only after required conditions are met; revisit the assessment when purpose, scale, data or consequential use changes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace assessment screening | Scope and applicable duty decisions have a documented rationale. |
| Inspect a material privacy risk | Mitigation and processing conditions address the actual flow. |
| Expand the use or affected population | The assessment is revisited before the changed processing. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Screening and assessment record
- Purpose, necessity and flow analysis
- Mitigation and approval decisions
- Reassessment and consultation records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unresolved material privacy risk to the processing owner and privacy or legal authority. Hold affected processing while required safeguards and external procedures are addressed.
Example in practice
Hypothetical example: A staff analytics tool would infer health-related patterns from routine activity. Assessment questions necessity and chooses a less intrusive aggregate approach instead of treating existing access to the records as sufficient justification.
Related controls
- CF01-008: AI Impact Assessment
- CF05-004: AI Data Flow Documentation
- CF05-015: Privacy-Enhancing Technologies for AI
Framework mappings
- NIST AI RMF (MAP 5.1)
- EU AI Act (GDPR Art. 35, EU AI Act Art. 9)
- ISO 42001 (Cl. 8.4)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0