AI Control Library / CF-05: Data Governance & Privacy
Designation: Core | Control types represented: Governance and Operational
Control requirement
Define and enforce approved purposes for AI data use, assessing new uses and combinations before processing expands. Separate service delivery, training, evaluation, profiling and supplier improvement rather than treating them as interchangeable purposes.
Why this matters
Information collected for one task can become attractive for a different analysis. Technical access or a broad platform setting does not establish that the new use is authorized or appropriate.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
AI source and generated information, including reuse across teams, model improvement, evaluation and external-provider processing.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The data owner approves purpose with privacy or legal review; stewards and system teams maintain associated restrictions.
Implementation guidance
- Record the specific intended purpose, affected information and permitted recipients, distinguishing primary processing from secondary use.
- Review proposed reuse and combination against applicable requirements, expectations and necessity, recording the decision and limits.
- Translate purpose restrictions into dataset access, environment separation, supplier settings and workflow controls where feasible.
- Monitor actual uses and revisit purpose decisions when users, features or processing roles change.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Trace a training or evaluation dataset | Its use is covered by a specific reviewed purpose. |
| Propose a materially different reuse | An owner assesses it before access or processing expands. |
| Inspect supplier improvement settings | Actual configuration agrees with the approved purpose. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Purpose and permitted-use register
- Reuse assessments and decisions
- Access and supplier settings
- Use review records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate incompatible or unapproved secondary use to privacy and data owners. Stop the affected reuse and assess any copies or learned artifacts already created.
Example in practice
Hypothetical example: A service desk wants to train a model on transcripts collected for resolving tickets. The owner reviews the new use and conditions instead of assuming that operational access authorizes training.
Related controls
- CF05-005: AI Data Ownership & Stewardship
- CF05-007: AI Data Protection Impact Assessment (DPIA)
- CF05-S17: Production AI Data Use Limitation
Framework mappings
- NIST AI RMF (MAP 1.1)
- EU AI Act (GDPR Art. 5(1)(b), EU AI Act Art. 10)
- ISO 42001 (Cl. 8.2, A7.1)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0