AI didn't create your privacy obligations. It stretched them.
You already answer to HIPAA, GDPR, or CCPA. What changed is that a tool nobody reviewed can now send the data somewhere nobody approved, and make a decision you have to be able to explain. Same duties, new surface.
Three moments privacy law meets an AI tool
“Someone pasted a client record into a chatbot.”
Whether that's a breach depends on which tool, what agreement is in place, and what the vendor does with it — three facts your inventory should already hold.
“A customer asked us to delete everything.”
You have 30 or 45 days depending on the law, and the answer has to include whatever went into the AI tools too.
“Explain how the system decided that.”
GDPR Article 22 and the CCPA ADMT rules both ask. The impact assessment you already completed is the explanation.
The privacy laws you already answer to
Each of these gets its own crosswalk showing where your program addresses it — and, just as usefully, where it doesn’t yet.
Notice before collection, deletion on request, an opt-out of automated decision-making, and knowing which vendors received what. The ADMT rules share Colorado's January 1, 2027 date.
The consumer privacy acts of states from Virginia to Texas: notices, the rights to access, correct and delete, and opt-outs of targeted advertising and profiling.
A lawful basis, a stated purpose, and the ability to explain an automated decision to the person it was made about. Article 22 is the one AI keeps walking into.
National privacy laws from the UK and Canada to Brazil, India and Singapore: lawful basis, notice, data-subject rights, breach notification and cross-border transfers.
If patient data could reach an AI tool, the business associate agreement and the safeguards have to be in place first — before the tool is switched on, not after.
Four things, and none of them is a PDF of the statute
A crosswalk per law
Each requirement sits next to the clause in your own program that answers it, and the ones nothing answers are listed as gaps rather than quietly omitted.
A privacy policy you can publish
Generated from your own answers and grounded in the same cited control library as everything else. Every plan from Starter, grounded in the NIST Privacy Framework, with each privacy law your plan includes added on top.
The deletion clocks, tracked
A request arrives, the clock starts. 30 days for GDPR, 45 for CCPA, counted for you, with the overdue ones surfaced before they are overdue.
A breach response plan
Written in advance, with the notification deadline on it, because the afternoon of a breach is the worst possible time to be drafting one.
The Privacy module comes with every plan: the privacy program, privacy impact assessments and a Privacy Policy from Starter; CCPA and the rest of the privacy paperwork on Pro and above; GDPR and HIPAA on Agency (GDPR on Pro in the UK, Canada and EU). A defensible starting point that you review and approve, not legal advice.
Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.
Find out what's leaving your building
The free scorecard asks what data your team puts into AI tools, and shows you the gaps.
Take the free scorecard →