For Heads-of · Practitioner
Unlawful or undocumented training data basis
Personal data used to train, fine-tune, or ground an AI system lacks a documented lawful basis, or exceeds the purpose and minimisation limits of the basis relied on.
- high
- data-protection
- lawful-basis
- training-data
How it happens
Personal data collected for one purpose, customer support transcripts, HR records, operational logs, is repurposed to train or fine-tune a model without anyone re-assessing whether the original lawful basis actually covers that new use.
Why it matters
An unlawful basis at the training-data stage taints everything built on top of it: retraining or deleting a model after the fact is far more disruptive than getting the basis right before training starts.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| Guidance on AI and data protection | Data minimisation | Data minimisation and accuracy |
| UK General Data Protection Regulation | Article 5 | Principles relating to processing of personal data |
| Guidance on AI and data protection | Lawfulness and transparency | Lawfulness, fairness and transparency |
Related resources
The external sources behind this risk, from the Resources library.