Data, Privacy & Records

Is information used lawfully, appropriately and with enduring control?

Govern the data entering AI, the information it creates and the traces it leaves—from provenance and permitted use to retention, access, quality and records obligations.

Operating principles

What good
looks like.

Purpose limitation

Information is used for a clear, authorised and compatible purpose.

Minimum necessary

Collection, disclosure, prompt content and retention are constrained.

Provenance and quality

Material data sources, limitations and transformations are understood.

Records by design

Prompts, outputs and decisions are captured when they form part of the official record.

Put it into practice

Make it
operational.

Map information flows

Trace collection, retrieval, inference, output, logging, sharing, storage and deletion.

Assess privacy

Identify authority, notice, disclosure, re-identification and individual impact.

Control knowledge sources

Set quality, access, currency, citation and stewardship rules.

Define the record

Determine what must be retained, where, for how long and with which audit trail.

Minimum evidence set

Make the decision
reviewable.

01Data-flow and information asset map

02Privacy impact assessment

03Dataset or knowledge-source documentation

04Retention, access and records schedule

Move from knowledge to practice

Design governance teams can operate.

Connect accountability, evidence and oversight to the way AI is actually delivered and used.

Start a conversation ↗