ai-data-privacy

To assess PII leakage in LLM prompts and completions, review prompt/context exposure, unsafe RAG retrieval across authorization boundaries, and output-side PII leakage risk. This privacy assessment flags third-party provider handling gaps to ensure personal data is not exposed during inference.

To check if AI training data contains PII and meets GDPR compliance, identify whether training or fine-tuning datasets contain personal information and verify appropriate legal basis, redaction, access controls, and deletion/DSAR handling exist within your data pipelines.

Model memorization risk in AI is the potential for deployed models to reproduce memorized personal data. It is evaluated by assessing whether deployed models may reproduce sensitive information and verifying whether outputs are protected by appropriate scanning and filtering mechanisms.

To verify data retention and deletion lifecycles for AI conversation logs and vector stores, check retention and TTL configurations, ensure deletion propagation works correctly, and review backup and audit retention practices to prevent data retention failures.

Yes, you can use this privacy assessment for RAG applications processing personal data. It evaluates AI/ML systems that handle personal data through prompts, context assembly, and RAG, flagging unsafe retrieval across authorization boundaries and output-side PII leakage risks.

Yes, the assessment maps AI privacy findings to NIST AI RMF 1.0 and OWASP LLM02:2025. It produces structured findings for governance risks, training-data PII handling, inference-time exposure, retention lifecycle failures, and model memorization concerns requiring compliance evidence.