Whose information does this system see, and where does it go?
Baseline: 1Enhanced: 23 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where it processes personal data (B4). Go as deep as your system letter, and implement in your mode.
Why it exists
Map the personal data across the whole life of the system, not only its main store. For every AI system, establish what personal information it processes and at which stage: the data it was trained or adapted on, the data it consults to answer, and — the two that are always missed — the data that arrives in the prompts people type into it and the data that accumulates in the logs it keeps. You cannot protect, minimise, or delete what you have not located, and the located inventory is the foundation every other dimension of this domain builds on.
What to actually do
Trace personal data through training, consultation, prompting, and logging. For each system, answer four questions: what personal data trained or adapted it; what personal data it looks up when it runs; what personal data users put into it in the course of using it; and what personal data ends up in its logs and stored history. The last two are where the exposure hides, because no one designed them to hold personal data — they simply accumulate it.
Record the numeric representations as personal data too. AI systems routinely convert your documents and records into numeric representations — long lists of numbers the model uses to find and compare information. These derived stores are built from the original data and can carry its personal content forward, yet they are almost never treated as personal data. Add them to the inventory; a privacy obligation that stops at the original record and never reaches its numeric shadow is only half met.
Connect this inventory to the one you already keep. This is not a separate exercise: it extends the AI inventory from the Governance domain with a privacy lens. Tag each asset there with the personal data it touches and the rules that govern that data, so privacy is visible at the asset, not reconstructed during an incident or an access request.
Controls
Baseline1 controls
Control 147
Maintain a per-system record of the personal data processed at each stage.
Training, consultation, prompting, and logging — the last two included by default, not on request.
How to implement it · Minimum content
Stage: training or adaptation data, consulted sources, prompts and uploads from users, logs and stored histories
Personal data categories at each stage (e.g. names, contact details, financial, health)
Whose data: customers, staff, applicants, third parties named in documents
Where it is stored and for how long, including on the provider's side
Record owner and date of last review
How to start
For each AI system, ask its owner four questions — what trained it, what it looks up, what users type or upload, what its logs keep — and fill one row per stage.
Evidence
The per-system record with all four stages completed, prompts and logs included.
Mode: light / standard / full
light
One spreadsheet tab per system, filled by the person who manages the tool, using the provider's documentation for training and log details.
standard
The system owner keeps the record alongside the AI inventory and the privacy lead checks it before each go-live.
full
The privacy function keeps the records in its privacy register, partly fed by automated data-flow discovery, and reviews them on every change.
Enhanced2 controls
Control 148
Include derived numeric stores in the personal-data inventory.
EnhancedPreventiveall rolesper system
What it is
Treated as personal data wherever they are built from it.
How to implement it · Minimum content
Store identifier and the system that uses it (e.g. the document index a search assistant consults)
Source data it was built from and the personal data categories it carries over
How it is refreshed when the source data changes or is deleted
Access and retention, matching those of the source data
Link to the source entry in the per-system personal-data record
How to start
List every place where documents or records are converted into numeric representations for search or comparison, and mark each as personal data wherever any of its sources is.
Evidence
Inventory entries for each derived store with its source data and personal data categories.
Mode: light / standard / full
light
Ask the provider or integrator which indexes the tool builds from your documents and add each to the record.
standard
The system owner registers each derived store when it is built, as an item on the deployment checklist.
full
Derived stores are discovered from the platform configuration and registered in the privacy register with their lineage to source data.
Control 149
Tag every AI asset with its personal data and governing rules.
EnhancedPreventiveall rolesper system
What it is
Carried in the Governance inventory, kept current as the system changes.
How to implement it · Minimum content
Personal data categories the asset touches, taken from the per-system record
Special categories present: health, ethnic origin, beliefs, biometrics, data on minors
Data subjects: customers, staff, applicants, members of the public