Research · Data for AI

Privacy & Data Sovereignty in AI

AI systems often process personal data, and AI services often process it across borders. Privacy law and data sovereignty requirements shape what data you can use, where it can go and what you must tell people.

Privacy questions AI raises

Is there a lawful basis for using personal data to train or operate this AI system?
Were people told their data might be used this way?
Can individuals exercise rights such as access, correction and deletion?
Does the system make automated decisions with significant effects on people?
Could the model reveal personal data it was trained on or given?

Sovereignty and residency

Data sovereignty concerns which laws govern data and which authorities can access it. AI services may process prompts, files and logs in regions different from where data is stored. Laws such as the EU General Data Protection Regulation restrict transfers of personal data outside the European Economic Area unless safeguards are in place, and some sectors and governments require data to remain in-country.

Controls that help

Privacy impact assessments for AI uses involving personal data.
Data minimization and de-identification before AI processing.
Contract terms on processing location, retention and training use.
Regional or private deployment options for sensitive workloads.
Customer-managed encryption keys where appropriate.

Common pitfalls

Assuming vendor AI features process data in the same region as the main service.
Using customer data for model training without checking notices and consent.
No way to honor deletion requests for data already used in AI.