AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Operational and Technical
Control requirement
Authorize and protect transfers of sensitive AI-related information across systems, providers and trust boundaries. Verify destination, purpose, recipient access and safeguards, and block transfers outside the approved conditions.
Why this matters
Encryption protects a transfer channel but does not establish that the recipient should receive the information. Generated outputs and tool calls can disclose sensitive data through paths absent from the original ingestion design.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Prompts, datasets, retrieval content, outputs, logs and exports crossing internal or external boundaries, including agent-initiated transfers.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data owner authorizes transfer; engineering and security enforce destination and access controls with privacy or legal review as needed.
Implementation guidance
- Identify sensitive categories, permitted destinations and recipient roles from the inventory and flow documentation.
- Establish purpose and applicable transfer conditions, minimizing payloads and reviewing supplier handling and onward transfers.
- Enforce approved endpoints, service identities and protected channels; inspect sensitive output and tool-action paths where appropriate.
- Test prohibited destinations, excessive payloads and changed routing, recording transfer events without unnecessary sensitive duplication.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt an unapproved destination in a controlled test | The relevant boundary prevents or contains the transfer. |
| Trace an approved sensitive transfer | Purpose, recipient and safeguards match authorization. |
| Change a downstream routing service | Review and enforcement cover the new destination before data flows. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Transfer approvals and destination register
- Channel and egress configuration
- Supplier handling evidence
- Boundary tests and transfer records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Contain unauthorized transfers and notify security, privacy and data owners. Preserve proportionate evidence, assess recipients and affected information, and restore access only under approved conditions.
Example in practice
Hypothetical example: A support agent proposes sending a full case file to a public translation endpoint. Destination and data rules block the transfer, while an approved internal route provides only the needed text.
Related controls
- CF05-003: AI Data Classification
- CF05-013: AI Data Location & Residency Controls
- CF03-018: Third-Party Plugin & API Risk Management
Framework mappings
- CSA AICM (DSP-10)
- NIST AI RMF (MAP 1.1)
- EU AI Act (Art. 10, GDPR Art. 46)
- ISO 42001 (Cl. 8.2, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0