5.2 Data Privacy, Intellectual Property & Tool Security

5.2 Data Privacy, Intellectual Property, and Tool Security

Core principle: Know what data enters an AI system, where it goes, what the provider may do with it, who can access it, how long it remains, and how outputs are verified. Product labels are not security guarantees.

---

Data Flow Before Prompting

Map the full path: user interface, API, application logs, safety monitoring, vendor services, subprocessors, regional storage, retrieval index, backups, and output destinations. For each step, establish purpose, authority, minimization, access, retention, deletion, incident response, and evidence.

Useful data classes are organization-specific. A simple model might distinguish public, internal, confidential, and restricted material, but the allowed destination and control must come from approved policy and contracts. Public data can still carry copyright, misinformation, or personal-data risk. Internal data is not automatically safe for any “enterprise” tool.

Do not place passwords, API keys, private keys, session tokens, or production secrets in a model prompt. Use secret scanning, narrow credentials, short-lived tokens, and revocation. Proprietary source, unreleased strategy, customer records, health or financial data, and named team feedback need explicit authorization and appropriate safeguards.

Verify Vendor Terms

Consumer services vary in retention, training choice, account settings, and human review. Enterprise and API offerings also vary. Zero Data Retention may be limited to particular endpoints and can coexist with narrowly retained abuse-monitoring data or customer-side logs. Encryption in transit does not answer training, access, deletion, or tenant-isolation questions.

Before use, verify the exact service, plan, region, API, date, settings, data-processing terms, subprocessors, deletion commitments, breach terms, audit evidence, and model-training provisions. Security certifications provide evidence about a control program; they do not guarantee that a particular use is safe or legally compliant.

Privacy and Data Protection

Privacy obligations depend on jurisdiction, role, data, purpose, legal basis, contracts, and system effect. GDPR, CCPA/CPRA, HIPAA, and other laws have different scopes and requirements. Avoid statements that sending data to AI automatically violates a named law or that a single contract automatically makes it compliant.

Apply privacy-by-design: minimize fields, use synthetic or de-identified data when it genuinely meets the need, restrict access, set retention, support correction and deletion, assess high-risk processing, and involve privacy or legal specialists. Redaction is not infallible; combinations of attributes can re-identify people.

Intellectual Property and Licensing

Generated content may resemble protected material, omit attribution, use a restricted dependency, or incorporate confidential input. Rights can depend on human contribution, jurisdiction, license conditions, distribution, derivative-work analysis, and contract. The United States Copyright Office's human-authorship guidance is not a worldwide ownership rule.

The GNU GPL is a copyleft license with obligations that can apply when covered work or a derivative is distributed. It is inaccurate to say any matching fragment automatically “infects the entire codebase.” Obtain qualified analysis of provenance, substantial similarity, combination, distribution, and license compatibility.

Controls include software-composition analysis, dependency allowlists, official registry verification, code search for suspicious similarity, source and prompt records where appropriate, attribution, and legal review. These reduce risk; no scanner proves clean-room originality.

Prompt Injection and Tool Security

Untrusted documents, websites, issues, and emails can contain instructions intended to override the application. Delimiters help readability but do not stop injection. Treat retrieved text as data, separate trusted instructions, restrict tools and network destinations, require confirmation for consequential actions, validate arguments and outputs, and test adversarial inputs.

An agent with repository, cloud, email, or deployment access expands the blast radius. Use least privilege, isolated environments, action and spend limits, observable logs, rollback, and a kill switch. A model's explanation of what it did is not a substitute for actual tool logs.

Definition of Done

Add applicable privacy and security evidence to the product's Definition of Done: for example secret scanning, authorized data use, threat-model updates, dependency checks, access-control tests, injection tests, logging review, or retention behavior. Select criteria by product risk. Scrum does not require every team to use the same checklist or a special gate solely because a model assisted with wording.

Scrum Mapping

Developers remain accountable for quality. The Product Owner accounts for value and effective Product Backlog management, including transparent risk trade-offs. The Scrum Master helps the team and organization remove impediments and improve effectiveness. None of these accountabilities makes one person a universal privacy lawyer; involve the relevant specialists.