Privacy Practices
Compliance · 5 min
Practical steps to implement data protection in your AI projects.
Technical & Organizational Measures (TOM)
- Encryption at rest and in transit
- Access controls and authentication
- Logging and monitoring
- Regular security testing
- Staff training
- Incident response plan
Data Processing Agreement (DPA)
- Contract with all processors
- Processors must meet GDPR standards
- Right to audit
- Sub-processor approval required
Documentation
- Art. 30 Processing Records
- Data Protection Impact Assessment (DPIA)
- Consent management
- Processing purposes
- Retention schedules
Data Subject Rights
| Right | Deadline |
|---|---|
| Access | 1 month |
| Rectification | 1 month |
| Erasure | 1 month |
| Portability | 1 month |
AI-Specific Considerations
- Log AI decisions for accountability
- Document training data sources
- Implement human oversight
- Regular bias testing
- Transparency in AI communications
Related articles
Compliance
GDPR Basics
What does GDPR mean for AI applications? Data protection, consent, retention.
Compliance
Data Protection Impact Assessment (DPIA)
DPIA for AI systems: When is a Data Protection Impact Assessment required, how to conduct one, and what to document.
Security
API Keys Secure Storage
Vault, Environment Variables, Secrets Management for AI Stack.
Was this article helpful?
Continue the learning path
The learning path puts these articles in order, and the Hub carries the building blocks we have checked in our own operations.
Why AI Engineering
- Local and self-hosted
- Documented and verifiable
- From our own operations
- Made in Austria
Not legal advice.