Policy Overview
Data Privacy
Ensures that Generative AI usage complies with the data protection principles and requirements.
Overview
This policy safeguards the handling of personal data during AI interactions, ensuring that AI-generated content, prompts, and logs do not violate data protection obligations under GDPR. The policy applies to all AI use cases where user data, customer information, or regulated personal data might be present. It works by monitoring and enforcing restrictions on personal identifiers and sensitive data from being ingested, processed, or exposed by LLMs.What the Policy Does
Purpose
The Data Privacy Policy ensures that sensitive and personally identifiable information (PII) is neither inadvertently shared with nor generated by the AI system. By integrating this policy, organisations can:- Ensure compliance with global data protection regulations.
- Prevent data leaks by restricting access to confidential information.
- Monitor and control AI-generated responses to prevent unauthorized data exposure.
Scope
Prompt Configuration
Before user inputs are processed by the LLM, the Data Privacy Policy scans and manages data transmission according to the following settings:-
Regulation Selection
Users can select predefined regulatory frameworks (e.g., GDPR, HIPAA, PCI-DSS) that automatically apply protective rules. -
Operational Modes
- Monitor Only – Detects sensitive data in user inputs without blocking the request.
- Monitor & Override – Prevents the transmission of prompts containing sensitive data, ensuring compliance and security.
-
Purpose
Ensures that confidential data is never inadvertently shared with the AI system.
Response Configuration
This configuration governs how LLM-generated responses are managed before being presented to users:-
Regulation Selection
Users can apply regulations to govern how the system detects and controls sensitive content in LLM-generated responses. -
Operational Modes
- Monitor Only – Flags AI responses that may contain sensitive information without restricting visibility.
- Monitor & Override – Blocks AI-generated responses containing sensitive information, ensuring secure communication.
-
Purpose
Protects end-users and organisations from receiving or distributing non-compliant or confidential information.
Key Features
- Predefined Regulatory Frameworks – Seamless compliance with industry standards.
- Real-time Monitoring & Enforcement – Detects and prevents unauthorized data exposure dynamically.
Why Use This Policy?
Benefits
- Enhances Data Security – Prevents data breaches and unauthorized access.
- Ensures Regulatory Compliance – Aligns AI interactions with global data protection laws.
- Mitigates Risk – Reduces legal and reputational risks associated with data mishandling.
Use Case: Law Firm Compliance
Scenario
A law firm uses AI to assist with contract drafting, legal research, and case summarisation. Given the sensitive nature of legal data, ensuring compliance with GDPR and attorney-client privilege is critical.Challenge
The firm must prevent confidential client information (e.g., case numbers, legal arguments, settlement amounts) from being exposed during AI interactions.Solution: Implementing the Data Privacy Policy
-
Prompt Configuration
GDPR and CPRA compliance rules are activated.
Monitor & Override mode is enabled to block unauthorized input transmissions. -
Response Configuration
AI-generated responses are reviewed under Monitor Only mode.
After initial evaluation, the setting is switched to Monitor & Override to restrict confidential disclosures.
How to Use the Policy
Note: The steps below guide you through configuring the Data Privacy Policy using the policy workflow interface.
Step 1: Navigate to the Policy Workflow
- From the Dashboard, open the Project Overview by selecting your project from the Project Table.
- In the Policy section of the Project Overview, click Edit Policy to launch the policy configuration workflow.
Step 2: Select and Enable the Data Privacy Policy
- In the Configure Policies tab, a list of available policies will be displayed.
- Click on Data Privacy to view its configuration options on the right-hand side.
- Toggle the Enable Policy switch to ON at the top of the panel to begin editing.
Step 3: Select Compliance Framework(s)
- Under the Compliance section, check the boxes for any applicable standards you wish to enforce (Example: GDPR, PCI-DSS , HIPAA etc.):
- You may select one or multiple frameworks based on your organisational requirements.
Step 4: Set Application Scope
- Under the Apply Policy To section, choose one of the following options:
- Prompt – Apply the policy to user input only.
- Response – Apply the policy to AI-generated responses only.
- Both – Enforce the policy on both user inputs and model outputs.
Step 5: Configure Enforcement Behaviour
- Under Behaviour, choose how you want the policy to respond to violations:
- Log Only – Log violations for visibility without blocking interactions.
- Log and Override – Block the interaction and return a smart response, based on your response configuration.
Step 6: Save, Test, and Apply the Policy
- Click Save Changes to store your current configuration.
- (Optional) Navigate to the Test Policies tab to validate your setup in a sandbox environment with a live chatbot.
- When ready, navigate back to the project dashboard to see and enforce your configuration.
- A success message will confirm the policy has been successfully applied to the project.
With the Data Privacy Policy, AltrumAI empowers your organisation to enforce strong data protection controls that align with leading compliance frameworks—ensuring responsible and secure AI usage.
Entity Types and Regulatory Compliance
| Entity Type | Entity Label | Entity Description | Regulatory Compliance |
|---|---|---|---|
| PII | Gender | Terms indicating gender identity or sexual orientation, including slang terms: male; female; males; females; bisexual; trans | CPRA, GDPR, APPI |
| PII | Physical Attribute | Distinctive bodily attributes, including terms indicating race: I’m 190cm tall; He belongs to the Black students’ association. | CPRA, GDPR, APPI |
| PII | Country | Country names: Canada; Namibia | GDPR, APPI |
| PII | Language | Names of natural languages: Korean; French; English; German | GDPR, APPI |
| PII | State | State, province, territory, or prefecture names: Ontario; Arkansas; Ich lebe in NRW | GDPR, APPI |
| PII | Place of Origin | Terms indicating nationality, ethnicity, or provenance: Canadian; Sri Lankan | CPRA, GDPR, Quebec Privacy Act, APPI |
| PII | Political Affiliation | Terms referring to a political party, movement, or ideology: liberal; Republican | CPRA, GDPR, Quebec Privacy Act, APPI |
| PII | Religion | Terms indicating religious affiliation: Hindu; Presbyterian | CPRA, GDPR, Quebec Privacy Act, APPI |
| PII | Username | Usernames, login names | CPRA, GDPR, APPI |
| PII | Age | Numbers associated with an individual’s age: 27 years old; 18 months old | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Date of Birth | Dates of birth: Born: March 7, 1961 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Driving License Number | Driver’s permit numbers: DL# 134711-320 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Email addresses: email@example.com | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA | |
| PII | NHS Number | Healthcare numbers and health plan beneficiary numbers: Policy No.: 5584-486-674-YM | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | IP Address | Internet IP address, including IPv4 and IPv6 formats: 192.168.0.12001:db8:0:0:0:8a2e::7334 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Location | Meta-class for any named location reference; See sub-classes below: Eritrea; Lake Victoria | GDPR, HIPAA, APPI |
| PII | Address | Full or partial physical mailing addresses, which can include: building name or number, street, city, county, state, country, zip code: 25/300 Adelaide T., Perth WA 6000, Aus. 145 Windsor St. Mail to: Kollwitzstr 13, 10405, Berlin | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Street Name | A subclass of “Address”, covering: a building number and street name, plus information like a unit numbers, office numbers, floor numbers and building names, where applicable: 25/300 Adelaide T., Perth WA 6000, Aus. 145 Windsor St. Mail to: Kollwitzstr 13, 10405, Berlin | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | City | Municipality names, including villages, towns, and cities: Toronto; Berlin; Denpasar | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Geographical Coordinates | Geographic positions referred to using latitude, longitude, and/or elevation coordinates: We’re at 40.748440 and -73.984559 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Post Code | Zip codes (including Zip+4), postcodes, or postal codes: 90210; B2N 3E3 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Name | Names of individuals, not including personal titles such as ‘Mrs.’ or ‘Mr.’: Dwayne Johnson; Mr. Khanna | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Family Name | Names indicating a person’s family or community; often a last name in Western cultures and first name in Eastern cultures: François Truffaut; Ozu Yasujirō | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | First Name | Names given to an individual, usually at birth; often first / middle names in Western cultures and middle / last names in Eastern cultures: François Truffaut; Ozu Yasujirō | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Professional Medical Name | Full names, including professional titles and certifications, of medical professional, such as doctors and nurses: Attending physician: Dr. Kay Martinez, MD | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Numerical PII | Numerical PII (including alphanumeric strings) that doesn’t fall under other categories. See also a section below on international variants as some of them are mapped to this category, for example, Belgian BTW nummer or European VAT number. | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Passport Number | Passport numbers, issued by any country: PA4568332; NU3C6L86S12 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Contact Number | Telephone or fax numbers: +4917643476050 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Social Security Number | Social Security Numbers or international equivalent government identification numbers: 078-05-1120; --3256 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | URL | Internet addresses: Unlock Your Business Potential with Aligne Consulting | CPRA, GDPR, Quebec Privacy Act, HIPAA |
| PII | Vehicle ID Number | Vehicle identification numbers (VINs), vehicle serial numbers, and license plate numbers: 5FNRL38918B111818; BIF7547 | CPRA, GDPR, APPI, HIPAA |
| PHI | Blood Group | Blood types: She’s type AB positive | CPRA, GDPR, Quebec Privacy Act, HIPAA |
| PHI | Medical Condition | Names of medical conditions, diseases, syndromes, deficits, disorders: chronic fatigue syndrome; arrhythmia; depression | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PHI | Medication | Medications, vitamins, and supplements: advil; Acetaminophen; Panadol | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PHI | Injury | Bodily injuries, including mutations, miscarriages, and dislocations: broke my arm; I have a sprained wrist | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PHI | Medical Procedure | Medical processes, including treatments, procedures, and tests: heart surgery; CT scan | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PCI | Bank Account Number | Bank account numbers and international equivalents, such as IBAN: Acct. No.: 012345-67 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA, PCI DSS |
| PCI | Credit Card Number | Credit card numbers: 0123 0123 0123 0123 **** **** ****4252 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA, PCI DSS |
| PCI | Credit Card Expiry Date | Expiration date of a credit card: Expires: July 2023; Exp: 02/28 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA, PCI DSS |
| PCI | CVV | 3- or 4-digit card verification codes and equivalents: CVV: 080 | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA, PCI DSS |
| PHI | Medical Code | Codes belonging to medical classification systems such as SNOMED, ICD-10, NDC, etc.: 1981-03-11T04:11:32-03:00 Forearm sprain SNOMED-CT 70704007; Abnormal levels of other serum enzymes | CPRA, GDPR, Quebec Privacy Act, APPI, HIPAA |
| PII | Date | Specific calendar dates, which can include days of the week, dates, months, or years: Friday, Dec. 18, 2002; Dated: 02/03/97 | HIPAA, Quebec Privacy Act |
| PHI | Statistics | Medical statistics: 18% of patients | HIPAA, Quebec Privacy Act |
| PII | Date Range | Broader time periods, including date ranges, months, seasons, years, and decades: 2020-2021; 5-9 May; January 1984 | HIPAA |
| Custom | Account Number | Customer account or membership identification number: Policy No. 10042992; Member ID: HZ-5235-001 | None |
| PII | Password | Account passwords, PINs, access keys, or verification answers: 27%alfalfa; temp1234 My mother’s maiden name is Smith | CPRA, APPI |
| Custom | Money | Names and/or amounts of currency: 15 pesos; $94.50 | None |
| Custom | Filename | Names of computer files, including the extension or filepath: Taxes/2012/brad-tax-returns.pdf | None |
| PII | Marital Status | Terms indicating marital status: single; common-law; ex-wife; married | APPI |
| PII | Organisation | Names of organisation or departments within an organisation: BHP; McDonald’s; LAPD | Quebec Privacy Act, APPI |
| Custom | Dosage | Medically prescribed quantity of a medication: limit intake to 700 mg/day | None |
| PCI | Cardholder Name | A cardholder name is the name on the front (or sometimes the back) of your credit card or debit card. It is a very important security feature for both in-person and online transactions. With in-person transactions, the name on the card lets the merchant know who is authorised to use the card. | PCI DSS |
| PCI | Card PIN | A PIN is a four- or six-digit number that the cardholder sets up when opening their account. It’s a unique and personal identification number that only the cardholder knows. The primary purpose of a PIN is to authenticate the cardholder when making a transaction. | PCI DSS |
| PCI | One-time PIN | One-time Password or OTP is a numerical code sent to your Registered Mobile Number (RMN) while you make online Credit Card transactions. The code comprises a four to six digit pass-code randomly generated through automated software when your bank or Credit Card company receives the transaction request. e.g. One Time Password | PCI DSS |
| PCI | Swift code | Routing number associated with a bank or financial institution. Like Institution number, branch number. Swift code stands for Society for Worldwide Interbank Financial Telecommunication. It is a systematic code, used to identify financial institutions internationally. e.g. IFSC Code | PCI DSS |
| PHI | Healthcare Facility | Names of medical facilities, such as hospitals, clinics, pharmacies, etc. For example, Northwest General Hospital; Union Family Health Clinic Certain aspects related to medical facilities can involve PII when they are linked with identifiable information about individuals. Here’s how this works: Location and Contact Information: — Facility Addresses and Contact Details Payment and Insurance Information: — Billing Records: Information related to payments for medical services, including insurance claims and coverage details, often include personal identifiers such as names, addresses, and insurance policy numbers. — Financial Transactions: Details of financial transactions related to medical services, when combined with personal identifiers, constitute PII. • Electronic Health Records (EHR): — Patient IDs: Unique identifiers assigned to patients within medical facilities are considered PII because they are used to track and manage individual health records. — Health Information: Any data related to an individual’s health condition, treatments, medications, and test results is considered highly sensitive PII. | Quebec Privacy Act, APPI |