APRF-18 · Data Privacy

Purpose

Minimize collection and exposure of personal and sensitive data across prompts, retrieval, memory, logs, and third-party model providers.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

PRI-M1L3 · DefinedTier 2 · ProductionhybridE3
Every production path that sends data to models shall apply a documented classification scheme covering AI payload classes, and every sensitive class shall have written handling rules (allow, redact, block, or equivalent).
Artifact
Data classification scheme covering AI/model-bound payload classes + Handling rules for each sensitive class (allow / redact / block or equivalent) + Automated or sampled audit showing 100% of sampled production model requests tagged, with sensitive handling matching policy
Pass condition
A classification scheme covers AI payload classes; ≥1 automated or sampled audit shows 100% of sampled production model requests tagged with a class; sensitive-class handling matches documented policy (audit/scheme measuredAt ≤90 days). If no production traffic sends data to models, score NOT_APPLICABLE.
Why this control exists
Threat map
Know which data classes reach models so sensitive classes can be handled under explicit rules.
Threats mitigated
Sensitive Information DisclosureData ExfiltrationSecret Leakage
Protects
DataContextSecretsUsers
MITRE: ATLAS AML.T0057 · ATLAS AML.T0024
Classification is the precondition for every downstream privacy control, since unclassified flows cannot be restricted or redacted. Knowing which classes reach the model bounds what LLM data leakage is capable of exposing.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
PRI-M2L3 · DefinedTier 2 · ProductionhybridE3
Where regulation or policy requires it, users or tenants shall have documented deletion and/or export paths that cover AI memory (conversation, durable, or retrieval-augmented stores) and in-scope AI logs, with a tested completion within a published SLA.
Artifact
Deletion/export procedure or API covering AI memory and in-scope AI logs + Successful test execution record for a sample tenant/user with measured duration vs SLA
Pass condition
Documented API/runbook covers AI memory and in-scope logs; a test shows deletion/export completes within SLA for a sample tenant/user with measured duration recorded (test evidence measuredAt ≤90 days). If neither memory nor in-scope logs exist, or deletion/export is not required, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure data subject deletion and export actually reach AI memory, traces, and logs.
Threats mitigated
Sensitive Information DisclosureUnauthorized Memory AccessRepudiation
Protects
DataMemoryLogsUsers
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
AI memory and trace stores are routinely missed by deletion tooling, leaving regulated data live after an erasure request is marked complete. Executable deletion and export paths close that gap; the driver is legal obligation rather than an adversary technique.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
PRI-M3L4 · Quantitatively ManagedTier 3 · Mission CriticalhybridE3
Regulated workloads shall be labeled, and model/tool routing shall keep 100% of sampled regulated requests in approved regions—enforced by policy or gateway controls, not prompt instructions alone.
Artifact
Routing policy config naming approved regions for regulated tenants/workloads + Sample routing decisions (or deny logs) showing 100% of sampled regulated requests stayed in approved regions
Pass condition
Regulated workloads are labeled; 100% of sampled regulated requests stay in approved regions (routing sample/policy evidence measuredAt ≤90 days). If no regulated workloads or tenants are in scope, or residency constraints do not apply, score NOT_APPLICABLE.
Why this control exists
Threat map
Prevent regulated workloads from being processed outside their permitted jurisdiction.
Threats mitigated
Sensitive Information DisclosureData Exfiltration
Protects
DataNetworkUsers
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Provider fallback and multi-region routing can silently move regulated data across borders during an incident, exactly when nobody is checking. Enforced residency routing keeps processing inside the permitted boundary; the risk is regulatory rather than adversarial.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Data flow diagrams for AI features
Provider DPA/terms review records
Deletion/export procedure evidence

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

PRI-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Production paths that send data to models should tokenize or redact documented high-sensitivity fields before the model call, with fail-closed behavior when redaction errors.
Artifact
Inventory or policy listing high-sensitivity fields subject to pre-model tokenization/redaction + Pre-model tokenization/redaction pipeline config with fail-closed on redaction errors + Sample of ≥50 production model requests showing 0 cleartext hits for those fields
Pass condition
Documented high-sensitivity fields never appear in cleartext in ≥50 sampled production model requests; the pre-model tokenization/redaction pipeline fails closed on errors (sample/pipeline evidence measuredAt ≤90 days). If production does not send data to models or no high-sensitivity fields are in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Remove or tokenize high-sensitivity fields before they reach a model.
Threats mitigated
Sensitive Information DisclosureData ExfiltrationSecret Leakage
Protects
DataSecretsContextUsers
MITRE: ATLAS AML.T0057 · ATLAS AML.T0024 · ATLAS AML.T0025
Redaction at the boundary means the model never holds the sensitive value, so no prompt, injection, or jailbreak can elicit it. This is the most durable available mitigation for model-mediated data leakage.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
PRI-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Every production third-party model provider should have a dated review of processing terms covering training use and retention, with a named owner; reviews older than 12 months should be treated as missing.
Artifact
Inventory of production model providers + Vendor terms review records (DPA/training/retention) with date and owner per provider
Pass condition
100% of production model providers have a review record ≤12 months covering training use and retention; 0 unreviewed providers in the inventory (inventory measuredAt ≤90 days; each review dated ≤365 days). If all models are fully self-hosted with no third-party processing, score NOT_APPLICABLE.
Why this control exists
Threat map
Ensure third-party model provider terms do not permit training on or over-retaining production data.
Threats mitigated
Sensitive Information Disclosure
Protects
DataModels
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Default provider terms may allow prompt and completion data to be retained or used for training, creating disclosure entirely outside the organization's technical control. Contract review is the only mechanism that constrains this, so no technique maps.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
PRI-R3L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Every major in-scope AI feature should have a completed DPIA/PIA (or equivalent privacy assessment) with owner sign-off before production traffic.
Artifact
Inventory of major in-scope AI features in or entering production + Completed DPIA/PIA (or equivalent) with owner sign-off per feature, dated before production traffic
Pass condition
100% of major in-scope AI features have a completed DPIA/PIA (or equivalent) with owner sign-off dated before production traffic (inventory/assessment evidence measuredAt ≤90 days). If no major in-scope AI features exist (or are entering production), score NOT_APPLICABLE.
Why this control exists
Threat map
Assess privacy and rights impact before a major AI feature reaches production.
Threats mitigated
Sensitive Information DisclosureBias and Discrimination
Protects
UsersDataSafety
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
A structured impact assessment surfaces privacy and fairness risk while the design can still change. It is a regulatory governance step with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

Privacy by design for AI means data minimization, purpose limitation, residency awareness, and contractual/technical controls on processors—not only a privacy policy page.

Why it matters

AI pipelines concentrate sensitive data. Over-collection and uncontrolled provider sharing create regulatory, contractual, and trust failures even when 'security' looks fine.

Common failures

Sending full customer records to external models when aggregates would do
No data classification for prompt contents
Training or eval sets with uncleared personal data
Ignoring residency requirements when choosing providers

Severity & risk

Severity: critical; Impact if violated
Risk level: high; Typical residual risk (impact × likelihood)

Engineering best practices

Default to least data in context
Separate privacy tiers of models (e.g., self-hosted for sensitive)
Ban pasting production data into consumer AI tools for debugging
Review eval datasets for personal data before publication

Automatic validations

DLP scanning on outbound model payloads where feasible
Policy checks preventing disallowed data classes from leaving the VPC
Automated deletion job verification

Manual validations

Privacy review for new AI features
Vendor assessments for new model providers

Examples

Support transcripts are redacted before being sent to an external LLM
A healthcare workload uses a residency-locked or self-hosted model path

References

Crosswalks

Privacy-Enhanced Privacy-Enhanced
NIST AI Risk Management Framework · aligns-with
§8 Operation
ISO/IEC 42001 · supports
Annex A AI system controls (selected themes)
ISO/IEC 42001 · partial
LLM02 Sensitive Information Disclosure
OWASP Top 10 for Large Language Model Applications · supports
C5.2 AI Resource Authorization & Classification
OWASP AI Application Security Verification Standard (AISVS) · supports
C7.3 Output Safety
OWASP AI Application Security Verification Standard (AISVS) · supports
C8.1 Access Controls on Memory & RAG Indices
OWASP AI Application Security Verification Standard (AISVS) · supports
C12.1 Request & Response Logging
OWASP AI Application Security Verification Standard (AISVS) · supports
CWE-200 Exposure of Sensitive Information
OpenCRE (Open Common Requirements Enumeration) · aligns-with
C1 Confidentiality
SOC 2 Trust Services Criteria · evidence-for
P-series Privacy (selected)
SOC 2 Trust Services Criteria · partial
Generative AI Lens Generative AI Lens (themes)
AWS Well-Architected Framework · aligns-with

Future evolution

Machine-readable privacy labels for model endpoints and agent capabilities.