Oversee the Privacy and Security Plan

You Own the Plan, Not the Cryptography

ECO Domain I, Task 1 makes you the owner of the AI project's privacy and security plan. That does not mean configuring key management or writing firewall rules. It means you decide what personal data the project is allowed to touch, confirm controls exist at every CPMAI phase, get the right people to sign the assessments, and produce evidence on demand. Engineers implement; you make sure the implementation is scoped, funded, scheduled, reviewed and documented. Exam scenarios test that judgment: a team wants to copy a production table into a sandbox to see what is in it, and the right answer is almost never "encrypt the bucket and carry on."

Build the PII Inventory Before Anyone Touches Data

Personally identifiable information (PII) is any data that identifies a person alone or in combination with other data. Your first artifact is a PII inventory built in Phase 2 Data Understanding: every candidate source, its owner, the personal fields it holds, where it lives, who can already see it, and the consent or contract it was collected under.

Classify each field into three groups, because the controls differ:

• Direct identifiers — name, national ID, email, account number, device ID. Removed or tokenized in almost every training set.
• Quasi-identifiers — ZIP code, date of birth, job title, visit date. Individually harmless, jointly re-identifying.
• Sensitive or special-category attributes — health, biometrics, race, religion, union membership, precise location. These carry extra legal conditions and often a stricter lawful basis.

Layer a sensitivity label on top (Public / Internal / Confidential / Restricted) so storage, sharing and vendor decisions follow the label rather than an argument.

Two principles govern what you may keep. Purpose limitation says data collected for one purpose cannot be repurposed to train a model without a valid basis — already holding the data is not permission to use it. Data minimization says you take only the fields the use case needs. On a claims-triage project, "pull the whole customer table because the data scientists might find something" fails both.

Encryption and Access Control for Training Data

Require encryption at rest for stored data (disks, object storage, database volumes, backups) and encryption in transit for anything moving between systems. Keys are managed separately from the data, by someone other than the person querying it.

Training corpora deserve their own line in the plan because they are a distinct asset that multiplies. One approved extract becomes a sandbox copy, a feature store, three notebooks on laptops, a labeled set sitting with an external vendor, and a series of model checkpoints. Every copy inherits the sensitivity of the original, and most fall outside the source system's controls. Ask on every project: how many copies now exist, where, and who deletes them?

For the AI workspace, insist on role-based access control (RBAC) and least privilege — the narrowest access that lets someone do the job, time-boxed where possible, logged always, reviewed on a cycle you own. Labeling contractors, vendors and leavers are the recurring gaps.

Privacy Impact Assessments

A privacy impact assessment (PIA) — a data protection impact assessment (DPIA) under GDPR — reviews what the processing does to people, not to systems. Typical triggers:

• large-scale processing of personal data
• special-category or criminal-offense data
• systematic monitoring or profiling
• automated decisions with legal or similarly significant effects on individuals
• combining datasets in ways the individual would not expect

Most AI projects trip at least one. Screen in Phase 1 Business Understanding and complete the full assessment before Phase 3 Data Preparation, because once transformed copies exist the findings cost far more to act on. The privacy officer or data protection officer signs it, legal reviews it, and the business sponsor accepts the residual risk. You schedule it, chase it, and treat approval as an entry condition to Phase 3.

GDPR and CCPA at Manager Depth

You are not expected to litigate, only to recognize three GDPR concepts. Lawful basis: every use of personal data needs one of six (consent, contract, legal obligation, vital interests, public task, legitimate interests) named before processing, not after. Data subject rights: access, rectification, erasure, portability, objection, plus specific protections around solely automated decision-making — which is exactly what an AI system does. Cross-border transfer: moving EU personal data to another country needs a legal mechanism, so "which region is the compute cluster in?" is a compliance question, not an infrastructure one.

CCPA/CPRA runs on a different default: an opt-out model where consumers can direct you to stop selling or sharing their personal information, alongside notice at collection and limits on sensitive personal information. GDPR asks permission first; CCPA lets people withdraw. A training set that must honor opt-outs needs that flag carried through the pipeline.

De-identification, Pseudonymization and Model Leakage

Pseudonymization replaces identifiers with tokens while a re-identification key still exists. Under GDPR that data is still personal data — the single most common misconception on live projects. Anonymization means re-identification is no longer reasonably possible, which is genuinely hard: combinations of quasi-identifiers such as ZIP code, birth date and gender re-identify a large share of a population, and joining a de-identified set to a public one can undo the work entirely.

Models add their own leakage. Large models can memorize training examples and reproduce them verbatim, and membership-inference attacks can reveal whether a specific record was in the training set. Prompts and inference logs quietly become a new store of personal data. Treat a leakage test as an acceptance criterion in Phase 5, not a research curiosity.

Secure Handling Across All Six Phases

Retraining is where plans decay. A deletion request honored in the production database but not in the archived training extract walks straight back into the next model build. Put erasure propagation, retention expiry and re-consent on the operations calendar with a named owner — Phase 6 is a loop, not an ending.