Sensitive Data Protection

[Applicable to all service providers]
1. Establish and implement an agreement to specify the service provider's role and obligations in processing sensitive data.

2. Establish procedures and implement measures to ensure that sensitive data is used only for the purposes specified in the agreement.

3. Establish and implement procedures to ensure that sensitive data is not used for marketing, advertisement, or AI model training without obtaining consent from the data owner.

4. Establish and implement procedures to inform the data owner if data processing and handling do not comply with applicable legislation and regulations.

5. Establish and implement procedures to provide the required information to support customers in fulfilling their compliance obligations.

6. Identify and maintain necessary records to demonstrate compliance with obligations.

7. Implement mechanisms to ensure temporary files that are created as a result of processing sensitive data are disposed according to established procedures.

8.Establish and implement processes to return, transfer, and dispose sensitive data securely.

9. Establish and implement processes to transmit sensitive data over secure data transmission networks and verify that the data reached its intended destination.

10. Establish and implement processes to inform customers in a timely manner about sensitive data transfer between jurisdictions, and provide customers an opportunity to object such transfers or terminate the agreement.

11. Establish and implement processes to inform customers of the locations to which sensitive data can possibly be transferred.

12. Establish and implement processes to disclose subprocessors used for processing sensitive data, including when and to whom the data was shared.

13. Establish and implement processes to notify customers of any legally binding requests for disclosure of sensitive information.

14. Establish and implement processes to disclose subcontractors, third party AI models, and open-source services used in processing sensitive information.

15. Establish and implement measures to limit or minimize the collection and processing of sensitive data.

16. Establish and implement measures to de-identify or delete sensitive data as soon as the intended purposes of use are completed.

17. Establish and implement measures to identify and address obligations for automated decision-making and automated content generation using sensitive information.

18. Establish and implement processes to perform privacy impact assessments and risk assessments.

19. Implement integrity checks to ensure sensitive data is not altered during transfer.

20. Establish and implement processes to classify data based on sensitivity and to apply appropriate protection measures.

21. Encrypt and or tokenize sensitive data both at rest and in use to prevent unauthorized access.

22. Implement data masking techniques to protect sensitive information during storage.

23. Anonymize or pseudonymize data to protect privacy and reduce the risk of exposing sensitive information.

24. Continuously monitor and log data access and usage to detect and respond to unauthorized activities.

25. Implement DLP tools to control what data can be entered or exported into generative AI systems.

26. Establish and implement data retention policies to ensure sensitive data is kept only as long as necessary.

27. Implement secure deletion methods (e.g., data wiping, degaussing) to permanently remove sensitive data.

28. Provide regular training on data protection practices and policies.

29. Establish and implement an incident response plan to address data breaches and security incidents.

1. Verify whether infrastructure policies and procedures include data privacy guidelines for managing sensitive data processed by AI workloads hosted or supported by the infrastructure.

2. Verify whether roles and responsibilities are defined for maintaining privacy and security controls across infrastructure components supporting AI systems (e.g., data storage, pipeline management).

3. Verify that sensitive data classification is integrated into service offerings; confirm isolation, access control, and encryption standards; validate compliance with customer and regulatory privacy requirements; interview technical and compliance staff; and confirm documentation is up to date.

4. Verify that the infrastructure includes mechanisms to safeguard sensitive data across its lifecycle—from data ingestion to runtime processing in AI pipelines.

5. Verify whether any infrastructure-related data privacy incidents involving hosted AI workloads were investigated, with evidence of corrective actions and customer communication.

6. Verify that risk management strategies include technical safeguards (e.g., secure compute environments, encryption at rest/in transit) to protect customer data and prevent misuse.

7. Verify that incident response plans for AI infrastructure cover customer data privacy breaches, including clear escalation, notification, and remediation workflows.