top of page

AI & Agents

AI Data Handling Policy

Which data may go into which AI tools, what a vendor must commit to before it gets that data, and how prompts, logs and training data are kept and deleted.

What’s inside

  • Data tiers for AI. Public to Restricted, with what each tier may do in AI tools, in training and in retrieval.
  • Vendor checklist. Training on your data, retention, location, deletion, data processing agreement and security evidence.
  • Personal data. Purpose, minimisation, impact assessments and decisions about people, mapped to the GDPR.
  • Training and retrieval data. Provenance records, permission, and access control that carries into the retrieval index.
  • Logs and incidents. Retention by record type, leak testing, and the 72-hour breach clock.

How to use it

  1. Start from your existing data classification and add the AI columns.
  2. Fill the vendor checklist for every tool before it is approved.
  3. Agree retention periods with whoever owns records and privacy.
  4. Replace every bracketed part and delete clauses that do not apply.

USE NEXT

AI Agent Permission Policy

bottom of page