4.1 Data governance and lifecycle management
Organizations shall establish proportionate governance for data used to develop, validate, test and operate AI systems, covering collection, origin, preparation, labelling, access, security, use, sharing, correction, retention and deletion. Material data shall remain traceable through transformations and restrictions, with original, inferred, synthetic and human-created information appropriately distinguished.
4.2 Data quality
Data used to develop, validate, test or operate an AI system shall meet technical standards for accuracy, completeness, consistency, timeliness and integrity. Quality shall be measured throughout the data pipeline, with controls for collection, labelling, transformation, validation, correction, versioning and drift proportionate to the system’s intended function and the consequences of error.
4.3 Privacy, processors and data transfers
Personal data shall be processed in accordance with applicable data-protection law. Organizations shall remain accountable when engaging AI providers or other processors that process personal data on their behalf and shall ensure appropriate instructions, contractual safeguards, security, control of subprocessors, and transparency regarding where and by whom data are processed. Transfers to other jurisdictions shall occur only where the required legal basis and safeguards are in place.
4.4 Control over personal data in models
Organizations shall recognize that deleting source data may not remove information learned, inferred or memorized by an AI model. Personal data used for training, fine-tuning or operation shall therefore be minimized and protected through measures that prevent unauthorized retention, extraction and reuse and, where feasible, enable correction, deletion or unlearning. Sensitive processing should take place within a controlled environment. Locally deployed or open-weight models may be used where they provide greater control over data and can be securely governed and maintained.