AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Governance, Operational and Technical
Control requirement
Define and control permitted data processing and storage locations for AI, accounting for primary services, replication, support, logs, backups and suppliers. Verify that actual configuration and terms support the applicable location conditions.
Why this matters
A selected storage region does not necessarily describe inference, support access or secondary processing. Residency and transfer decisions need to follow the information and the service’s real capabilities.
How the control types work together
Governance controls establish applicable external obligations. Operational controls define ownership, review and response. Technical controls enforce data boundaries or provide the evidence needed to verify the actual operation.
When it applies
AI data processing with geographic, contractual or other externally imposed location conditions, including hosted and distributed environments.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data and service owners are accountable; privacy or legal determines conditions and platform teams implement location controls.
Implementation guidance
- Identify applicable location and transfer requirements for data categories and use, documenting scope and interpretation.
- Map processing, storage, replication and support locations, checking service-specific commitments and material suppliers.
- Configure region restrictions and approved routing where supported, addressing egress and fallback behavior.
- Test location evidence and review changes in provider terms, subprocessors and recovery arrangements before affected processing expands.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Inspect a selected service region | Evidence addresses relevant processing and copies rather than storage alone. |
| Exercise an unavailable-region scenario | Fallback does not silently route sensitive information to an unapproved location. |
| Review support or supplier access | Its location and conditions have been assessed. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Location requirements and decisions
- Processing and replication map
- Region and routing configuration
- Provider and failure-path evidence
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unapproved location or unreliable residency evidence to privacy, legal and service owners. Restrict the affected data path while an acceptable arrangement is established.
Example in practice
Hypothetical example: A provider stores documents in the chosen region but uses a different endpoint for inference. Review identifies the additional processing location and changes the routing before restricted records are used.
Related controls
- CF05-004: AI Data Flow Documentation
- CF05-008: AI Sensitive Data Transfer Controls
- CF05-018: AI Data Sub-processing Controls
Framework mappings
- CSA AICM (DSP-19)
- NIST AI RMF (MAP 1.1)
- EU AI Act (GDPR Art. 44, EU AI Act Art. 10)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0