Home / Standards / Privacy & Data Handling

Privacy & Data Handling Standard

Standard ID: GCAIS-STD-003
Standard IDGCAIS-STD-003
Versionv1.0
Published2026-01-15
StatusActive
Review Due2028-01-15 (24-month cycle)
SupersedesInitial publication

Table of Contents

  1. Scope
  2. Definitions
  3. Requirements
  4. Assessment Criteria
  5. Compliance Indicators
  6. Version History

1. Scope

This standard establishes requirements for the handling of personal data by organizations operating AI systems in production. It applies to the collection, storage, processing, and sharing of data relating to identifiable natural persons, including data used for training, inference, and evaluation purposes.

The requirements in this standard are intended to supplement, not replace, applicable data protection law. Where legal requirements are more stringent than these standards, legal requirements prevail. Compliance with this standard does not constitute legal compliance with any applicable data protection regulation.

This standard does not apply to AI systems that process no personal data, nor to data that has been irreversibly anonymized such that re-identification is not reasonably possible.

2. Definitions

Personal Data
Any information relating to an identified or identifiable natural person, including data that could be used in combination with other data to identify a person.
Data Minimization
The practice of collecting and retaining only the minimum personal data necessary for a specified and documented purpose.
Retention Schedule
A documented policy specifying the categories of personal data collected, the purpose of collection, and the maximum period for which each category is retained.
Data Subject
The natural person to whom personal data relates.

3. Requirements

REQ-003-1: Data Minimization The organization shall document the personal data collected for each AI system in scope, the purpose of collection, and the basis for concluding that collection is limited to data necessary for that purpose. Collection practices shall be reviewed following any material change to system functionality.
REQ-003-2: Retention Schedule The organization shall maintain a documented retention schedule specifying the maximum retention period for each category of personal data processed by AI systems in scope. Data shall be deleted or anonymized within the scheduled period. The retention schedule shall be reviewed at intervals not exceeding 24 months.
REQ-003-3: Subject Access Mechanism The organization shall implement a documented mechanism by which data subjects may request access to, correction of, or deletion of personal data held in connection with AI systems in scope. The mechanism shall be accessible without requiring technical expertise, and requests shall be acknowledged within 5 business days.
REQ-003-4: Third-Party Data Agreements Where personal data processed by AI systems is shared with or received from third parties, the organization shall maintain documented agreements specifying the purpose of sharing, the categories of data shared, and the responsibilities of each party for data protection. Third-party agreements shall be reviewed at intervals not exceeding 24 months.
REQ-003-5: Cross-Border Transfer Controls Where personal data is transferred to jurisdictions outside the organization's primary operating jurisdiction, the organization shall document the transfer mechanism and the basis for concluding that adequate protections are in place for data subjects in the origin jurisdiction.

4. Assessment Criteria

Assessment is conducted through documentation review of data inventories, retention schedules, third-party agreements, and subject access procedures. Assessors will verify that documented practices are implemented by sampling operational records and testing subject access mechanisms.

5. Compliance Indicators

Requirement Compliant Indicator Non-Compliant Indicator
REQ-003-1 Data inventory documents purpose and necessity for each data category No inventory, or collection not linked to documented purpose
REQ-003-2 Retention schedule current and enforced; deletion records available No schedule, or schedule not enforced in practice
REQ-003-3 Subject access mechanism functional and acknowledgement within required window No mechanism, or mechanism requires technical expertise to use
REQ-003-4 Documented agreements exist for all material third-party data relationships Agreements absent or not reviewed within required intervals
REQ-003-5 Transfer documentation identifies mechanism and adequacy basis Transfers occurring without documented mechanism or adequacy assessment

6. Version History

Version Date Notes
v1.0 2026-01-15 Initial publication. Adopted by Standards Board resolution 2026-01-12.
GCAIS-STD-003 Privacy & Data Handling Standard v1.0 (HTML) Request PDF version