AI Data Privacy Checklist: Essential Questions to Ask Before Signing Up

Before you sign up for an AI service, ask how it collects, uses, stores, shares, and deletes data. Review the vendor’s privacy terms, technical safeguards, and contract, then confirm that its practices fit your business and legal obligations.

Data Collection and Purpose Limitation: The First Gate

Start by identifying what the tool collects and why. Distinguish between information you submit, metadata the service captures automatically, and data generated through your use.

Key questions to ask:

• What categories of data does the tool collect?
• Does the vendor state a specific purpose for each category?
• Is additional data needed to provide the service, or is collection broader than necessary?
• Does the vendor collect information from outside your organization?
• What controls can you use to limit collection?
• Does the privacy notice explain how information may be combined with other data?

Red flag: The vendor uses vague language such as “to improve our services” without explaining what it collects, why it collects the data, or how it uses the data.

Model Training and Inference Data: The Critical Distinction

Data submitted for an AI response is not necessarily treated the same way as data retained for model development. Ask the vendor to explain each use separately.

For inference data, ask:

• Does the vendor retain prompts, uploaded files, query context, or generated responses?
• Can you configure the retention period?
• Is the data stored after processing?
• Can the vendor delete information associated with your account?
• Does the service distinguish between conversational history, operational logs, and data used to improve the product?

For training or product-improvement data, ask:

• Does the vendor use customer inputs to train or fine-tune models?
• Is that use voluntary, optional, or required?
• Can you object to the use of your data?
• Does the policy cover prompts, uploads, feedback, and generated responses?
• What happens to your data if you leave the service?

Ask for contractual protection if customer data must not be used for model training. Do not rely only on a sales representative’s verbal assurance.

Data Residency and Cross-Border Transfers

AI services may send information to facilities or service providers in other jurisdictions. Determine where the data is stored, processed, and accessed.

Essential questions:

• In which jurisdictions does the vendor store data?
• Can you choose a storage region?
• Where are backups and support records stored?
• Which locations process the data?
• Does the vendor disclose the legal bases and safeguards used for international transfers?
• Can you review the vendor’s current list of transfer mechanisms?
• Will the vendor notify you before changing a material transfer arrangement?

Negotiation point: Ask for contractual rights concerning service-provider locations, changes to transfers, and your ability to raise objections or terminate the agreement where appropriate.

Sub-Processor Transparency and Supply Chain Risk

An AI service may depend on other providers for hosting, payment processing, analytics, content moderation, or customer support. Ask which providers handle your information and what each one does.

Due diligence questions:

• Request a current list of sub-processors.
• Ask each sub-processor’s role and the type of data it handles.
• Request the locations where each provider operates.
• Ask how the vendor assesses and monitors its providers.
• Does the vendor pass its privacy and security obligations to sub-processors?
• What notice does the vendor provide before adding or replacing a provider?
• Can you object to a material change?

Review available independent assurance reports, but ask what period they cover, what controls they examine, and what they leave unaddressed. A report may not cover every aspect of an AI system or your particular use of it.

Data Retention and Deletion Workflows

A short privacy statement is not enough. You need to know when data is deleted, where backups are handled, and how deletion requests work.

Verification questions:

• What is the default retention period for prompts, uploads, responses, logs, and account data?
• Can you configure shorter retention periods?
• Does deletion remove the data from active systems and backups?
• Can you request deletion through the platform or a support channel?
• Does the vendor provide written confirmation when deletion is complete?
• What happens to data after the contract or account ends?
• Are derived records, support files, and security logs covered by the deletion policy?

Best practice: Test the deletion process using non-sensitive information before you rely on it for important records. Include deletion deadlines, confirmation, exceptions, and backup treatment in the agreement where possible.

Access Controls, Encryption, and Audit Logging

Ask what technical controls protect the data throughout its lifecycle.

Technical verification:

• Is data encrypted while moving between your systems and the vendor?
• Is stored data encrypted?
• Can encryption keys be managed or controlled by your organization?
• Does the service support role-based access controls?
• Can administrators, users, auditors, and support staff have different permissions?
• Does the vendor limit privileged access and require approval for sensitive actions?
• Can audit logs show who accessed or changed data and when?
• Are audit logs protected from unauthorized changes?
• Can administrators review access activity and export logs?

For sensitive workloads, ask whether the vendor offers additional protections during processing. Also check whether security features are available only on certain plans or require separate configuration.

Incident Response and Breach Notification

Confirm how the vendor handles security incidents and whether its commitments give you enough time to respond.

Contractual questions:

• When will the vendor notify you after discovering a security incident?
• What information must the notification contain?
• Does the vendor investigate the cause and scope of the incident?
• Will the vendor provide updates during the investigation?
• What assistance does the vendor provide with containment, investigation, and notification?
• What obligations apply if a sub-processor is involved?
• What remedies or indemnity provisions apply to losses caused by the vendor?

Review these terms against your legal obligations and your own incident-response plan. Define how you will notify customers, partners, employees, and regulators when necessary.

Contractual Audit Rights and Independent Verification

Do not rely on a sales conversation or a general security page when your information is sensitive.

Rights to secure:

• Can you review relevant audit reports and security summaries?
• Can you request evidence that agreed controls are operating?
• Can you verify deletion, access restrictions, and incident-response procedures?
• What happens if an assessment identifies a serious problem?
• Does the contract provide time to correct the problem?
• Can you terminate the agreement if the vendor fails to meet an essential obligation?

Ask whether reports are current and whether they cover the specific service, region, and configuration you are considering.

Practical Review Checklist

Before signing, complete the following review:

• Identify the information the service will receive.
• Confirm that each category of information has a necessary purpose.
• Separate inference, training, and product-improvement uses.
• Check storage, processing, support, and sub-processor locations.
• Review retention and deletion controls.
• Verify encryption, permissions, and audit logging.
• Confirm incident-notification responsibilities.
• Request contractual safeguards for data ownership, confidentiality, training use, and deletion.
• Compare the vendor’s protections with your sensitivity of the information.
• Ask unresolved questions in writing before signing.

FAQ

Q: What is the most overlooked question on an AI data privacy checklist?

Whether customer inputs are used for model training or product improvement. Confirm the answer in the written policy and the contract.

Q: How should you review an AI tool used for decisions about people?

Identify the purpose of the tool, assess the data it uses, examine human oversight, and check whether your legal obligations require an assessment before deployment.

Q: What should you do if the vendor’s privacy policy is unclear?

Ask the vendor to explain the relevant terms in writing. Do not sign an agreement or upload sensitive information while the meaning of the data practices remains uncertain.

Q: Can an independent security report replace your own review?

Use it as evidence, not as a substitute. Check its scope, date, exclusions, and whether it covers the service and configuration you are evaluating.

Q: How often should you review the service?

Review the privacy policy, settings, sub-processor list, retention practices, and contract changes on a regular basis and whenever your use of the service changes materially.