Data security strategy for AI
What is Data security strategy for AI?
A plan for protecting personal and confidential data at every point an AI system touches it, from training through to each prompt and response. AI adds data paths that older security plans don’t cover. Data can be absorbed during training or fine-tuning, loaded into a search index, typed into prompts, revealed in outputs and kept in vendor logs.
A data security strategy sets rules and controls for each path. These include: what data AI may use, how it’s classified and minimised, where it’s processed, who can reach it and how long it’s kept.
Why organisations need Data security strategy for AI?
Under the Privacy Act 1988, APP 11 requires reasonable steps to protect personal information and APP 8 covers sending it overseas. APRA-regulated entities must also meet CPS 234 on information security.
AI raises stakes because mistakes are hard to undo. A model that has learned personal information can’t unlearn it easily, and a prompt pasted into a public AI tool cannot be recalled. A serious leak may need reporting under the Notifiable Data Breaches scheme.
How to build Data Security strategy for AI?
- Map which data each AI system uses, in training and at inference.
- Classify it and remove what’s not needed.
- Decide what can train a model and what is retrieval only.
- Apply controls per stage: masking, access checks, prompt and output filtering.
- Set hosting location, vendor terms and retention, then test.
