Are the protections around this data matched to how sensitive it is?
Baseline: 1Advanced: 12 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where it processes personal data (B4). Go as deep as your system letter, and implement in your mode.
Why it exists
Apply protection proportionate to the data, and reach for the stronger techniques where the sensitivity earns them. The ordinary protections — encryption, tight access — remain necessary but are not always sufficient for AI, which can expose information indirectly, through what it infers and reveals rather than through a stolen file. Where the data is sensitive and the use justifies it, stronger techniques exist that let you get value from data without exposing the individuals in it; use them deliberately, matched to the risk, not as a box-ticking default.
What to actually do
Encrypt and tightly control access to personal data throughout the AI system. The baseline that everything else assumes: personal data is encrypted where it rests and where it moves, and only the components and people that need it can reach it — including the derived numeric stores, which are often left unprotected precisely because no one thinks of them as personal data.
Where sensitivity justifies it, use techniques that protect the individual, not only the file. Two are worth naming plainly. One lets you learn patterns from a dataset while making it mathematically hard to identify any single person within it — useful when you need the aggregate, not the individual. Another lets a model be trained across data that never leaves the systems or devices holding it, so the sensitive data is never centralised at all. Neither is free, and neither is always warranted; apply them where the sensitivity of the data and the stakes of the use make the cost worthwhile.
Controls
Baseline1 controls
Control 156
Encrypt personal data at rest and in transit across the AI system, including derived stores.
Access limited to the components and people that require it.
How to implement it · Minimum rules
In transit: encrypted connections for every flow to and from the model, the provider and the data stores
At rest: encryption on for source data, derived numeric stores, logs and conversation histories
Access: only the components and named roles that need the data; no shared accounts
Keys and credentials kept in a secrets manager or the provider's key service, never in code or documents
Access lists reviewed periodically (e.g. every six months) and whenever someone leaves
How to start
List the system's stores, logs and search index included, and confirm for each, from the provider's settings or documentation, that encryption is on and who has access.
Evidence
The configuration or provider statement confirming encryption per store, and the current access list.
Mode: light / standard / full
light
Rely on the provider's built-in encryption, confirmed in its documentation, and restrict administrator and user access to named people.
standard
IT configures encryption and role-based access for each store, derived stores included, and reviews access lists twice a year.
full
Organisation-managed keys, central identity management for access, and automated checks flagging any unencrypted store.
Advanced1 controls
Control 157
Apply individual-protecting techniques where sensitivity and use justify them.
AdvancedPreventiveall rolesper system
What it is
Chosen deliberately and matched to the risk, not applied as ritual.
How to implement it · Steps
Identify datasets whose sensitivity and use justify more than encryption and access control (e.g. health records used for training)
Choose per case: added statistical noise that hides individuals when only aggregates are needed, or training where data never leaves the systems holding it
Set the protection parameters against the risk (e.g. how much noise, how much each individual may influence results)
Measure the accuracy cost and confirm the use still serves its purpose
Record the decision and reasoning, including cases where a technique was considered and rejected
How to start
For the most sensitive dataset used in training or analysis, record whether a stronger technique is warranted, which, and why.
Evidence
The per-dataset decision record with technique, parameters, accuracy impact and reasoning.
Mode: light / standard / full
light
Obtain the technique as a provider option or commission it from a specialist, with the system owner recording the decision.
standard
The data science team applies the technique and the privacy lead signs off the decision record.
full
A privacy engineering function sets when each technique is required and reviews the parameters.
Evidence
Encryption and access configuration covering derived stores; the record of where stronger techniques were applied and the reasoning for it.