AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Operational and Technical
Control requirement
Protect sensitive information throughout AI processing through proportionate minimization, authorization, isolation, disclosure controls and response. Address both supplied content and sensitive information generated or inferred by the system.
Why this matters
Information can be exposed through retrieval, memorized content, outputs or logs even when database access is restricted. Protection needs to cover the full workflow and how users can influence it.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
Confidential, personal, regulated and security-sensitive AI information, including embeddings and model artifacts where exposure could reveal protected content.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data owner defines access and use conditions; engineering and security enforce and test protections with privacy input.
Implementation guidance
- Identify sensitive sources, inferred information and disclosure paths using classification and data-flow evidence.
- Minimize sensitive inputs and isolate users, tenants and retrieval permissions, enforcing authorization outside the model where feasible.
- Apply appropriate output and logging protections without relying solely on a prompt instruction or a single content detector.
- Test unauthorized retrieval, cross-user exposure, indirect prompts and handling failures using safe fixtures, then route findings for correction.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt cross-user retrieval in a controlled test | Authorization prevents access to the protected records. |
| Submit a safe disclosure test | Required input, output and log boundaries apply consistently. |
| Inspect a sensitive inference | It receives appropriate protection even when the original inputs were lower sensitivity. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Sensitive-data and exposure assessment
- Access and isolation configuration
- Disclosure-path tests
- Remediation and response records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Contain ongoing disclosure and notify security, privacy and the data owner. Assess affected content and recipients and verify protection before restoring the exposed path.
Example in practice
Hypothetical example: A user asks an assistant to summarize another team’s restricted files. Retrieval authorization denies the files before generation rather than asking the model to remember a confidentiality instruction.
Related controls
- CF05-003: AI Data Classification
- CF12-004: AI Knowledge Base & RAG Access Control
- CF12-013: AI Sensitive Information Disclosure Prevention
Framework mappings
- CSA AICM (DSP-17)
- NIST AI RMF (MAP 1.1)
- EU AI Act (GDPR Art. 9, EU AI Act Art. 10(5))
- ISO 42001 (Cl. 8.2, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0