Data Privacy

​

Overview

This policy safeguards the handling of personal data during AI interactions, ensuring that AI-generated content, prompts, and logs do not violate data protection obligations under GDPR. The policy applies to all AI use cases where user data, customer information, or regulated personal data might be present. It works by monitoring and enforcing restrictions on personal identifiers and sensitive data from being ingested, processed, or exposed by LLMs.

​

What the Policy Does

​

Purpose

The Data Privacy Policy ensures that sensitive and personally identifiable information (PII) is neither inadvertently shared with nor generated by the AI system. By integrating this policy, organisations can:

• Ensure compliance with global data protection regulations.
• Prevent data leaks by restricting access to confidential information.
• Monitor and control AI-generated responses to prevent unauthorized data exposure.

​

Scope

​

Prompt Configuration

Before user inputs are processed by the LLM, the Data Privacy Policy scans and manages data transmission according to the following settings:

• Regulation Selection
  Users can select predefined regulatory frameworks (e.g., GDPR, HIPAA, PCI-DSS) that automatically apply protective rules.

• Operational Modes

  • Monitor Only – Detects sensitive data in user inputs without blocking the request.
  • Monitor & Override – Prevents the transmission of prompts containing sensitive data, ensuring compliance and security.

• Purpose
  Ensures that confidential data is never inadvertently shared with the AI system.

​

Response Configuration

This configuration governs how LLM-generated responses are managed before being presented to users:

• Regulation Selection
  Users can apply regulations to govern how the system detects and controls sensitive content in LLM-generated responses.

• Operational Modes

  • Monitor Only – Flags AI responses that may contain sensitive information without restricting visibility.
  • Monitor & Override – Blocks AI-generated responses containing sensitive information, ensuring secure communication.

• Purpose
  Protects end-users and organisations from receiving or distributing non-compliant or confidential information.

​

Key Features

• Predefined Regulatory Frameworks – Seamless compliance with industry standards.
• Real-time Monitoring & Enforcement – Detects and prevents unauthorized data exposure dynamically.

​

Why Use This Policy?

​

Benefits

• Enhances Data Security – Prevents data breaches and unauthorized access.
• Ensures Regulatory Compliance – Aligns AI interactions with global data protection laws.
• Mitigates Risk – Reduces legal and reputational risks associated with data mishandling.

​

Use Case: Law Firm Compliance

​

Scenario

A law firm uses AI to assist with contract drafting, legal research, and case summarisation. Given the sensitive nature of legal data, ensuring compliance with GDPR and attorney-client privilege is critical.

​

Challenge

The firm must prevent confidential client information (e.g., case numbers, legal arguments, settlement amounts) from being exposed during AI interactions.

​

Solution: Implementing the Data Privacy Policy

1. Prompt Configuration
   GDPR and CPRA compliance rules are activated.
   Monitor & Override mode is enabled to block unauthorized input transmissions.

2. Response Configuration
   AI-generated responses are reviewed under Monitor Only mode.
   After initial evaluation, the setting is switched to Monitor & Override to restrict confidential disclosures.

​

How to Use the Policy

Note: The steps below guide you through configuring the Data Privacy Policy using the policy workflow interface.

​

Step 1: Navigate to the Policy Workflow

1. From the Dashboard, open the Project Overview by selecting your project from the Project Table.
2. In the Policy section of the Project Overview, click Edit Policy to launch the policy configuration workflow.

​

Step 2: Select and Enable the Data Privacy Policy

1. In the Configure Policies tab, a list of available policies will be displayed.
2. Click on Data Privacy to view its configuration options on the right-hand side.
3. Toggle the Enable Policy switch to ON at the top of the panel to begin editing.

​

Step 3: Select Compliance Framework(s)

1. Under the Compliance section, check the boxes for any applicable standards you wish to enforce (Example: GDPR, PCI-DSS , HIPAA etc.):
2. You may select one or multiple frameworks based on your organisational requirements.

​

Step 4: Set Application Scope

1. Under the Apply Policy To section, choose one of the following options:
   • Prompt – Apply the policy to user input only.
   • Response – Apply the policy to AI-generated responses only.
   • Both – Enforce the policy on both user inputs and model outputs.

​

Step 5: Configure Enforcement Behaviour

1. Under Behaviour, choose how you want the policy to respond to violations:
   • Log Only – Log violations for visibility without blocking interactions.
   • Log and Override – Block the interaction and return a smart response, based on your response configuration.

​

Step 6: Save, Test, and Apply the Policy

1. Click Save Changes to store your current configuration.
2. (Optional) Navigate to the Test Policies tab to validate your setup in a sandbox environment with a live chatbot.
3. When ready, navigate back to the project dashboard to see and enforce your configuration.
4. A success message will confirm the policy has been successfully applied to the project.

With the Data Privacy Policy, AltrumAI empowers your organisation to enforce strong data protection controls that align with leading compliance frameworks—ensuring responsible and secure AI usage.

​

Entity Types and Regulatory Compliance