Data Privacy & AI Tools

Last updated: 2026-05-18

Data Privacy and AI Tools

When you use AI tools, your data goes somewhere. Where it's stored, whether it's used for training, and whether you can get it deleted all have compliance implications. This guide covers how the main privacy laws apply to AI, what to ask vendors, and a checklist you can use before adopting any new tool.

How Privacy Laws Apply to AI

GDPR applies when you process personal data belonging to EU residents. If you're passing that data to an AI tool, the vendor becomes a data processor and you need a lawful basis, updated privacy notices, and usually a Data Processing Agreement.

Singapore PDPA covers similar ground: consent, purpose limitation, access rights, correction, and deletion. It applies to data belonging to Singapore residents.

CCPA/CPRA gives California consumers rights to know what's collected, delete it, correct it, and opt out of its sale. If you're processing data from California residents through AI tools, you need to confirm those vendors support these rights.

Other jurisdictions have their own rules. Know where your users are.

Key Questions for Any AI Vendor

Where is data stored? Region and country matter for data residency and cross-border transfer rules.

Is data used for training? Many vendors train on user input unless you opt out. Check the terms and opt out if your compliance requirements demand it.

Can data be deleted? Full deletion, not just deactivation. How long does it take, and is it verifiable?

Do they offer a Data Processing Agreement? If you're handling EU personal data, this is required. Make sure it actually covers what you need.

Who are their subprocessors? The vendor isn't the only one who may see your data. A published subprocessor list is a good sign.

What's the retention period? Can you set shorter retention or trigger auto-deletion?

Practical Checklist

Run this before adding any AI tool that touches personal data. Red flags: no DPA, no deletion path, unclear training policy, no subprocessor list.