AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Governance and Operational
Control requirement
Implement a process for applicable individual data rights across AI data stores and workflows, including identity verification, scope assessment, coordinated action and a substantiated response. Record lawful limits and technical constraints explicitly.
Why this matters
Deleting a source record may leave retrieval entries, logs or supplier copies. Rights handling needs an inventory and coordinated evidence; it must not promise removal from trained weights merely because a database row was removed.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
Personal information used or generated by AI; qualified reviewers determine which access, correction, deletion, objection or related rights apply in the circumstances.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The privacy request owner coordinates; data stewards, system owners and providers execute approved actions and legal reviewers resolve limits.
Implementation guidance
- Provide an accessible intake and proportionate verification process, identifying applicable scope, timing and exceptions through qualified review.
- Locate relevant source, derived and supplier-held records using authorized references, avoiding unnecessary collection to identify a requester.
- Coordinate required actions and assess model-related effects separately, documenting practical limits and appropriate alternative safeguards.
- Verify completion across the identified scope and provide a clear response with required explanations and escalation routes.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace an authorized request | Applicable stores and participating owners are identified. |
| Review a deletion or correction claim | Evidence supports what changed without overstating effects on model weights or unknown copies. |
| Inspect an exception | Its authority, scope and communication are reviewed and recorded. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Rights-handling procedure
- Verified request and scope records
- Action and provider confirmations
- Reviewed response and exception decisions
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate missed scope, inability to perform required action or disputed rights to privacy and legal authorities. Restrict unsupported processing claims and implement the reviewed remedy or limitation.
Example in practice
Hypothetical example: A person asks for correction of a record used by a retrieval assistant. The team updates the source and index, checks relevant outputs and separately assesses whether any training use creates additional obligations.
Related controls
- CF05-002: AI Data Inventory
- CF05-011: AI Data Retention & Deletion
- CF05-018: AI Data Sub-processing Controls
Framework mappings
- NIST AI RMF (MAP 5.1)
- EU AI Act (GDPR Art. 15-17, EU AI Act Art. 26)
- ISO 42001 (Cl. 8.4)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0