§13.2 · CAPABILITY · 4 MIN READ · EDITION 1.0
Privacy posture for evidence containing personal data
Field reports, incident records and supplier communications can contain names, contact details or other personal data; evidence classification should account for this before that evidence reaches an AI-supported process.
Personal data inside otherwise technical evidence is easy to overlook; a data-classification review should explicitly check for it rather than assuming a document is purely technical because of its type.
Where personal data is present, apply the organisation's existing data-protection controls to the AI-supported process exactly as they would apply to any other processing of that data.
PUT THIS INTO PRACTICE
- 01Check technical evidence for embedded personal data before use.
- 02Apply existing data-protection controls to AI-supported processing.
- 03Escalate to the organisation's data-protection owner when in doubt.
RELATED INSTRUMENTS
CITE THIS SECTION
§13.2 · Edition 1.0 · Privacy posture for evidence containing personal data