For Heads-of · Practitioner
Data minimisation and lawful basis review
A documented check that any personal data used to train, fine-tune, or ground an AI system has a valid lawful basis and is limited to what's necessary.
- directive
- data-protection
- lawful-basis
- policy
What it does
Requires a documented lawful-basis and minimisation check before personal data already collected for another purpose is repurposed for AI training, fine-tuning, or grounding.
Where it fits
Mitigates unlawful-or-undocumented-training-data-basis before a model is ever trained, when it is still cheap to fix.
Risks this mitigates
The risks this control addresses, ranked by effectiveness.
Cross-border AI data transfer risk
Personal data processed by an AI system, including via a cloud or model provider, is transferred outside the UK without an adequate transfer mechanism.
Unlawful or undocumented training data basis
Personal data used to train, fine-tune, or ground an AI system lacks a documented lawful basis, or exceeds the purpose and minimisation limits of the basis relied on.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Guidance on AI and data protection | Data minimisation | Data minimisation and accuracy |
| UK General Data Protection Regulation | Article 5 | Principles relating to processing of personal data |