Foundations of Data, Privacy, and AI Governance

Introduction

Organizations increasingly compete through data. Customer interactions, operational records, financial transactions, sensor readings, employee information, and machine-generated events support decisions that were once based primarily on experience or intuition. Artificial intelligence (AI) intensifies this dependence: models require large, representative, well-managed datasets, while their outputs may influence lending, recruitment, insurance, healthcare, policing, pricing, and public services.

Yet data is not automatically valuable merely because it exists. Data creates organizational value when it is relevant, accurate, accessible to authorized users, protected against misuse, interpreted appropriately, and connected to legitimate business objectives. Poorly governed data produces duplicated records, inconsistent reports, regulatory exposure, biased decisions, security incidents, and loss of trust.

Data governance provides the organizational system through which data-related authority, responsibility, standards, processes, and controls are established. Privacy addresses the rights and interests of people whose data is collected or used. AI governance extends these concerns to automated and semi-automated systems, including questions of explainability, fairness, human oversight, safety, and accountability.

This chapter establishes the conceptual foundation for these fields and introduces major professional frameworks, including DAMA, COBIT, ISO standards, and the NIST AI Risk Management Framework.

Learning Objectives

By the end of this chapter, you should be able to:

1. Define data, information, personal data, sensitive data, metadata, data governance, privacy, and AI governance.
2. Explain why data should be treated as a strategic organizational asset rather than merely an IT resource.
3. Distinguish data governance from data management, information security, privacy management, and AI governance.
4. Analyze governance principles such as accountability, transparency, proportionality, integrity, and fairness.
5. Explain major data rights and the responsibilities of organizations that process personal data.
6. Compare the purposes and emphases of DAMA, COBIT, ISO, and NIST frameworks.
7. Apply governance concepts to an organizational case involving analytics and AI.
8. Evaluate contemporary governance challenges, including generative AI, third-party processing, and conflicting regulatory expectations.

1. Essential Terminology

Data, information, and knowledge

Data consists of recorded observations, representations, or symbols. A transaction identifier, timestamp, temperature reading, customer rating, or text message is data. Data may be structured, semi-structured, or unstructured.

Structured data fits a predefined model, such as rows and columns in a relational database. Semi-structured data contains organizational markers but does not conform fully to a tabular model; JSON and XML are common examples. Unstructured data includes free text, images, audio, video, and many documents.

Information is data interpreted in a context that gives it meaning. A value of “42” is data; “42 days since the customer’s last purchase” is information. Knowledge involves understanding relationships, implications, and appropriate action. A manager who knows that prolonged inactivity predicts churn possesses knowledge derived from information and experience.

The distinction is not absolute. The same artifact can be data in one context and information in another. Governance must therefore address both the technical object and the meaning assigned to it.

Personal and sensitive data

Personal data is information relating to an identified or identifiable natural person. Names, identification numbers, device identifiers, location data, online identifiers, and inferential profiles may qualify, depending on applicable law and context.

Sensitive personal data generally receives enhanced protection because misuse may cause heightened harm or discrimination. Categories may include health information, biometric data, financial information, precise location, political opinions, religious beliefs, or information about children. Definitions and legal requirements vary across jurisdictions; organizations must not assume that a single global definition applies everywhere.

Pseudonymization replaces direct identifiers with codes while retaining a possibility of re-identification through additional information. Anonymization aims to make identification no longer reasonably possible, taking account of available data, methods, and resources. Removing names alone does not necessarily anonymize a dataset because combinations of attributes can re-identify individuals.

Metadata and data quality

Metadata is data about data. Examples include a field definition, source system, creation date, retention period, classification, owner, lineage, and permitted use. Metadata enables discovery, interpretation, control, and auditability.

Data lineage describes the origin, transformations, movement, and destinations of data. It is particularly important when an analytical result or AI prediction must be explained or challenged.

Data quality is multidimensional. Common dimensions include accuracy, completeness, consistency, timeliness, validity, uniqueness, and fitness for purpose. A dataset can be accurate but not timely, complete but biased, or consistent internally but invalid for the intended decision.

Governance-related terms

Data governance is the exercise of authority and control over the management of data assets. It establishes decision rights, accountability, policies, standards, and oversight.

Data management is the operational and technical practice of collecting, storing, integrating, securing, maintaining, using, and disposing of data. Governance determines what should be done and who has authority; management implements and operates those decisions.

Data stewardship is the responsible, domain-specific practice of maintaining data quality, definitions, usage rules, and issue resolution. A data steward often works between business users, compliance personnel, and technical teams.

Data owner is the person or organizational unit accountable for a data domain or business use. Ownership does not imply personal possession. Data custodian is the party responsible for technical operation and protection, often an IT team or cloud provider.

Privacy concerns how information about people is collected, used, disclosed, retained, and deleted, together with the rights and reasonable expectations of those people. Information security protects information and systems against threats to confidentiality, integrity, and availability. Security supports privacy but does not exhaust it: an organization can securely process data for an unfair or unauthorized purpose.

AI governance is the system of policies, roles, controls, evaluation practices, and oversight mechanisms that guide the responsible design, acquisition, deployment, monitoring, and retirement of AI systems.

2. Data as an Organizational Asset

Organizations commonly describe data as an asset, but data differs from physical assets in important ways. It can be copied at low marginal cost, used simultaneously by many teams, combined with other datasets to create new value, and reused for purposes not anticipated at collection. Its value is contextual rather than fixed. A customer dataset may be valuable for service improvement but inappropriate for unrelated advertising.

Data has at least five strategic characteristics:

1. Decision value: It improves prediction, planning, control, or learning.
2. Operational value: It enables processes such as payment, logistics, service delivery, and compliance reporting.
3. Innovation value: It supports new products, personalization, research, and automation.
4. Risk value: It helps detect fraud, cyber threats, quality failures, and regulatory breaches.
5. Relational value: It can strengthen or damage trust among customers, employees, suppliers, regulators, and communities.

The asset perspective must not become an argument for unlimited extraction. Personal data is connected to human dignity, autonomy, and rights. An organization may have lawful access to data without having unlimited ethical permission to exploit it.

The data life cycle

A governance program should address the complete data life cycle:

1. Planning: define purpose, need, risks, and lawful basis.
2. Collection or creation: obtain data fairly and record provenance.
3. Storage and maintenance: apply quality, security, classification, and retention controls.
4. Use and sharing: authorize access and assess compatibility with the original purpose.
5. Archiving: preserve information when there is a continuing legal, historical, or operational need.
6. Disposition: securely delete, destroy, or irreversibly anonymize data when retention is no longer justified.

Controls that focus only on storage are incomplete. For example, a company may encrypt a database effectively yet violate privacy by collecting excessive data or retaining it indefinitely.

3. Principles of Data and AI Governance

Although laws and standards differ, several principles recur across governance systems.

Accountability

Accountability means that an organization can demonstrate responsible decision-making, not merely claim that policies exist. It requires named roles, documented purposes, risk assessments, records of processing, evidence of control operation, and mechanisms for correction and redress.

Accountability is distributed. Executives set risk appetite; boards provide oversight; legal and privacy officers interpret obligations; product managers define uses; data stewards maintain meaning and quality; engineers implement controls; users follow procedures; and independent assurance functions test effectiveness.

Purpose limitation and proportionality

Data should be collected and used for specified, legitimate purposes. Purpose limitation constrains secondary uses that are incompatible with the original context. Data minimization requires collecting and retaining no more data than necessary. Proportionality asks whether the expected benefit justifies the intrusion, risk, and potential harm.

These principles are especially important in AI projects, where teams may collect broad datasets “just in case” and search for uses later. Technical feasibility is not a sufficient justification for processing.

Transparency and explainability

Transparency concerns communicating what data is used, why it is used, with whom it is shared, and what rights people have. Explainability concerns making a model’s operation or output understandable enough for appropriate evaluation and challenge.

Explainability is not a single technical property. A senior executive may need an explanation of business purpose and risk; a regulator may need evidence of controls; an affected individual may need a meaningful reason for a decision; and an engineer may need feature-level diagnostics. The appropriate explanation depends on audience and decision impact.

Integrity, quality, and traceability

Data and models should be sufficiently accurate, complete, current, and fit for their intended use. Traceability allows an organization to identify sources, transformations, versions, approvals, and responsible parties. Without traceability, errors are difficult to diagnose and accountability becomes diffuse.

Fairness and non-discrimination

Fairness requires identifying and addressing unjustified disparities in outcomes, error rates, access, or treatment. It is not always equivalent to treating everyone identically. A policy can be formally neutral yet produce discriminatory effects because historical data reflects unequal opportunities or because a proxy variable encodes protected characteristics.

Fairness criteria can conflict. For example, equalizing a model’s false-positive rates across groups may be incompatible with equalizing predictive values when groups have different base rates. Governance therefore requires normative judgment, stakeholder engagement, and context-specific assessment rather than reliance on one universal metric.

Security and resilience

Confidentiality, integrity, and availability remain fundamental. AI systems add risks such as prompt injection, training-data poisoning, model extraction, membership inference, unauthorized tool use, and unsafe automation. Controls should be proportionate to the sensitivity of data and consequences of failure.

Human agency and contestability

People affected by significant decisions should have appropriate information, avenues for review, and a meaningful opportunity to challenge errors. Human involvement is not meaningful if a reviewer lacks authority, time, competence, or access to relevant evidence. “Human in the loop” is therefore a governance design question, not merely a checkbox.

4. Data Rights and Ethical Responsibility

Data rights differ by jurisdiction, but common rights include:

• the right to receive understandable information about processing;
• the right to access personal data and relevant processing information;
• the right to correct inaccurate data;
• the right to deletion or erasure in defined circumstances;
• the right to restrict or object to certain processing;
• the right to data portability in applicable situations;
• rights concerning automated decision-making and profiling in some legal regimes.

Rights may be limited by law, public interest, contractual necessity, security requirements, or the rights of others. Organizations must establish procedures for identity verification, response deadlines, exemptions, escalation, and audit records.

Ethical responsibility extends beyond minimum legal compliance. Lawfulness asks whether conduct is permitted; ethics asks whether it is responsible, justifiable, and respectful. A legally permissible use may still be manipulative, exploitative, discriminatory, or inconsistent with reasonable expectations.

A useful ethical analysis considers four questions:

1. Who benefits and who bears the risk?
2. Could affected people reasonably anticipate the use?
3. Would the organization defend the practice publicly and consistently?
4. What remedy exists if the system causes harm?

Ethical responsibility also includes institutional power. Individuals may technically consent while lacking a realistic ability to refuse essential services. Consent should therefore not be treated as a universal solution to power imbalances, poor comprehension, or excessive data collection.

5. Governance Architecture and Accountability

A mature governance system links strategy, policy, process, technology, and assurance. A typical architecture contains:

• governance bodies: board committees, executive councils, data governance councils, and AI review boards;
• policies and standards: classification, retention, access, quality, privacy, model risk, and acceptable-use rules;
• roles: accountable executives, owners, stewards, custodians, privacy officers, security teams, model validators, and internal auditors;
• repositories: data catalogs, processing inventories, model inventories, risk registers, and decision logs;
• control processes: impact assessments, access reviews, quality monitoring, incident response, change control, and third-party due diligence;
• assurance: testing, audit, independent review, regulatory reporting, and continuous improvement.

The “three lines” model is useful. The first line consists of business and technology teams that own risks and operate controls. The second line provides specialist oversight, such as privacy, compliance, risk, and information security. The third line, typically internal audit, provides independent assurance to governing bodies.

A RACI matrix can clarify responsibility: Responsible performs the work; Accountable owns the outcome; Consulted provides expertise; and Informed receives updates. Each important governance activity should have one clear accountable party, even if many parties are responsible for execution.

6. Major Frameworks

Frameworks should be treated as complementary instruments, not competing slogans. They provide structures and common language, but organizations must tailor them to sector, jurisdiction, size, risk, and organizational maturity.

DAMA-DMBOK

The DAMA Data Management Body of Knowledge (DAMA-DMBOK) organizes data management knowledge areas. These commonly include data governance, data architecture, data modeling and design, data storage and operations, data security, data integration, document and content management, reference and master data, data warehousing and business intelligence, metadata, and data quality.

DAMA is particularly useful for defining the scope of professional data management and for designing roles, capabilities, and operating models. Its emphasis is broad and practice-oriented. It does not by itself function as a jurisdiction-specific privacy law or a complete AI safety standard.

COBIT

COBIT, developed by ISACA, is an enterprise governance and management framework for information and technology. It emphasizes alignment with enterprise goals, governance objectives, processes, performance management, risk optimization, resource optimization, and stakeholder needs.

COBIT helps executives and auditors connect data and technology controls to business objectives. It is valuable for accountability, control design, assurance, and integration with enterprise risk management. Its scope is broader than data governance alone; therefore, detailed data definitions, privacy rights procedures, and model evaluation may require supplementary practices.

ISO standards

ISO and IEC standards provide internationally recognized management-system and control guidance. Relevant examples include:

• ISO/IEC 27001: requirements for an information security management system.
• ISO/IEC 27701: privacy information management guidance and requirements that extend information-security management practices.
• ISO/IEC 27002: information-security controls guidance.
• ISO/IEC 42001: requirements for an AI management system.
• ISO/IEC 23894: guidance on AI-related risk management.
• ISO/IEC 22989: concepts and terminology for AI.

ISO management standards emphasize documented processes, risk treatment, leadership, competence, monitoring, corrective action, and continual improvement. Certification can provide structured assurance, but certification is not proof that every individual AI decision is fair or that every privacy risk has been eliminated.

NIST frameworks

The NIST Cybersecurity Framework helps organizations manage cybersecurity risk through functions such as Govern, Identify, Protect, Detect, Respond, and Recover. It is useful for security governance surrounding data platforms and AI infrastructure.

The NIST AI Risk Management Framework organizes AI risk management around four functions: Govern, Map, Measure, and Manage. Govern establishes policies, roles, culture, and accountability. Map identifies context, intended use, affected stakeholders, and risks. Measure uses testing, evaluation, monitoring, and evidence. Manage prioritizes and treats identified risks across the AI system life cycle.

NIST frameworks are voluntary guidance rather than universal law. Their value lies in structured risk thinking, common terminology, and adaptable implementation profiles.

Framework comparison

An organization may use DAMA to define data capabilities, COBIT to align governance and assurance, ISO to establish auditable management systems, and NIST to assess AI-specific risks. The challenge is integration: duplicated controls and inconsistent terminology can create bureaucracy unless a common control library and ownership model are established.

7. Implementing a Governance Program

Implementation should begin with business objectives and material risks rather than with an attempt to catalog every data element immediately.

Step 1: Establish mandate and scope

Senior leadership should define why governance matters, which domains are in scope, what risks are unacceptable, and how decisions will be escalated. Scope may begin with high-impact domains such as customer identity, financial reporting, health data, or automated eligibility decisions.

Step 2: Inventory data and AI systems

Create inventories of major datasets, processing activities, vendors, models, applications, owners, classifications, and dependencies. A model inventory should include purpose, training data sources, version, performance evidence, limitations, deployment context, monitoring arrangements, and retirement criteria.

Step 3: Classify risk

Risk classification should consider sensitivity, scale, affected populations, decision impact, reversibility, likelihood of misuse, and dependence on automated outputs. High-impact systems merit stronger validation, human review, documentation, monitoring, and incident response.

Step 4: Define controls and measures

Controls should be specific and testable. Examples include access recertification, retention enforcement, consent or legal-basis records, data-quality thresholds, bias testing, model drift monitoring, secure development, vendor assessments, and documented appeal procedures.

Useful measures include the percentage of critical data elements with assigned owners, unresolved high-severity quality issues, completion of privacy impact assessments, access-review completion, model monitoring coverage, time to respond to rights requests, and time to contain incidents. Metrics should measure outcomes, not merely activity. Counting policies written is less informative than measuring whether unauthorized access decreases or whether affected people receive effective remedies.

Step 5: Monitor and improve

Governance is continuous. New data sources, vendors, models, laws, threats, and business purposes can change risk. Periodic review should examine incidents, complaints, audit findings, model performance, stakeholder feedback, and whether controls remain proportionate.

8. Illustrative Case: Meridian Finance’s Automated Credit Triage

Background

Meridian Finance, a fictional regional lender, introduces an AI system to prioritize small-business loan applications for human underwriters. The system uses application data, repayment history, transaction records, industry information, and selected external data. Management expects faster processing and lower default losses.

Problem

After deployment, approval rates differ substantially across geographic areas. A review shows that the model uses variables correlated with neighborhood deprivation and that historical lending data reflects earlier human decisions. Applicants receive only a generic message that their applications were “not prioritized.” Several records also contain inconsistent business revenue figures because different systems use different definitions of annual turnover.

Analysis

The case contains several governance failures. First, the purpose and decision impact were not adequately documented. Although the system technically prioritizes rather than makes the final decision, it materially influences underwriters and therefore requires meaningful oversight. Second, data quality and semantic consistency were weak. Third, historical data may encode structural disadvantage. Fourth, the organization lacks sufficient transparency and contestability. Finally, accountability is unclear: technology staff operate the model, but no executive owner is responsible for its social and financial consequences.

Approach and solution

Meridian establishes an accountable executive and a cross-functional review group including credit, data governance, privacy, compliance, model risk, security, and community representatives. It creates a model inventory and records intended use, prohibited uses, data sources, limitations, version history, and decision thresholds.

The data team creates a business glossary for revenue, restructures quality controls, and documents lineage. The model-risk team performs validation using holdout data and evaluates performance across relevant groups. Rather than assuming one fairness metric is decisive, the team examines approval rates, error rates, calibration, and the business justification for each feature. Variables that function primarily as unjustified proxies are removed or constrained.

Underwriters receive training and authority to override the system. Applicants receive clearer reasons, a route to correct inaccurate information, and access to human review. Monitoring is introduced for drift, data-quality failures, disparate outcomes, override patterns, and complaints. The system is paused automatically if predefined safety thresholds are exceeded.

Outcome

Processing time improves, but expected cost savings are lower than originally forecast because Meridian invests in controls and human review. Nevertheless, data corrections reduce avoidable rework, model performance becomes more stable, and the firm can explain decisions to applicants and regulators. The organization concludes that responsible governance is not an obstacle to analytics; it is an operating capability that makes analytics more reliable and defensible.

Learning points

1. A human decision-maker does not eliminate the need for AI governance.
2. Data quality is both a technical and a governance issue.
3. Fairness assessment requires context, multiple measures, and normative judgment.
4. Transparency must support understanding and correction, not merely provide a legal notice.
5. Accountability requires named owners, evidence, monitoring, and remedies.

9. Challenges and Limitations

Fragmented regulation

Organizations operating across jurisdictions face different definitions, rights, retention rules, cross-border transfer requirements, and sector obligations. A single global policy may be too weak for some locations and unnecessarily restrictive for others. Legal mapping and local expertise are necessary.

Governance theater

Policies, committees, and dashboards can create an appearance of control without changing behavior. Governance is effective only when decision rights are clear, controls operate in practice, exceptions are visible, and leaders act on evidence.

Excessive centralization

Central governance can improve consistency but may slow legitimate innovation and ignore domain knowledge. Federated models often work better: central teams define principles, minimum controls, and shared services while domain teams manage contextual decisions.

Technical limitations

Anonymization can fail under linkage attacks; encryption does not prevent authorized misuse; explainability methods can be incomplete; fairness metrics can conflict; and monitoring can miss rare harms. Technical controls must therefore be combined with organizational and ethical judgment.

Generative AI

Generative AI introduces uncertain outputs, fabricated citations, confidential-data leakage, copyright concerns, prompt manipulation, and unclear accountability when third-party foundation models are used. Organizations should define approved use cases, prohibit entering restricted information into unauthorized tools, require human verification for consequential outputs, document model and vendor dependencies, and establish escalation procedures for harmful or unreliable results.

Third parties and supply chains

Cloud providers, data brokers, software vendors, and model providers may process data or influence system behavior. Contracts should address purpose, security, retention, subcontracting, incident notification, audit rights, deletion, model training uses, and assistance with rights requests. Due diligence should evaluate actual practices rather than rely solely on marketing claims.

10. Best Practices for Graduate Professionals

Effective practitioners should:

• connect governance initiatives to measurable business and societal outcomes;
• define terms in a business glossary before attempting complex analytics;
• assign one accountable owner for each critical data and AI domain;
• design privacy and security into systems from the beginning;
• document purpose, provenance, lineage, assumptions, limitations, and changes;
• use proportional controls based on sensitivity and impact;
• test data and models across relevant populations and operating conditions;
• provide meaningful review, correction, and appeal mechanisms;
• integrate legal, ethical, technical, and business perspectives;
• treat vendors and foundation models as part of the governance boundary;
• monitor outcomes continuously and retire systems when they are no longer justified;
• use frameworks as adaptable tools rather than compliance checklists.

Chapter Summary

Data is an organizational asset because it supports operations, decisions, innovation, risk management, and relationships, but its value depends on quality, context, protection, and legitimate use. Data governance establishes authority, accountability, policies, standards, and oversight; data management performs the operational work. Privacy protects people’s interests and rights in relation to information about them, while information security protects confidentiality, integrity, and availability. AI governance extends governance to automated systems and emphasizes context, fairness, explainability, human agency, monitoring, and remedy.

Core governance principles include accountability, purpose limitation, minimization, transparency, integrity, security, fairness, proportionality, and contestability. DAMA-DMBOK provides a broad data-management structure; COBIT connects information and technology governance to enterprise objectives; ISO standards support auditable security, privacy, and AI management systems; and NIST frameworks provide adaptable risk-management guidance. These frameworks are complementary and must be integrated with organizational roles, inventories, controls, metrics, assurance, and continuous improvement.

Responsible governance is not limited to legal compliance or technical security. It requires organizations to consider power, context, affected stakeholders, foreseeable harm, and available remedies. In practice, effective governance makes analytics and AI more trustworthy, resilient, explainable, and sustainable.

Key Terms

Data: Recorded observations, symbols, or representations.

Information: Data interpreted within a meaningful context.

Personal data: Information relating to an identified or identifiable person.

Sensitive personal data: Personal data requiring heightened protection because misuse may cause significant harm.

Metadata: Data describing the characteristics, origin, structure, or use of other data.

Data lineage: A record of data origins, transformations, movement, and destinations.

Data quality: The degree to which data is accurate, complete, consistent, timely, valid, unique, and fit for purpose.

Data governance: The exercise of authority and control over data-related decisions and practices.

Data management: The operational and technical management of data throughout its life cycle.

Data steward: A person responsible for maintaining data meaning, quality, and appropriate use within a domain.

Data owner: The party accountable for a data domain or business use.

Data custodian: The party responsible for technical operation and protection of data.

Privacy: The protection of people’s interests and rights concerning the collection and use of information about them.

Information security: Protection of information and systems from threats to confidentiality, integrity, and availability.

AI governance: Policies, roles, controls, and oversight for responsible AI life-cycle management.

Purpose limitation: Restricting data processing to specified and compatible purposes.

Data minimization: Limiting collection and retention to what is necessary.

Pseudonymization: Replacing identifiers with codes while retaining a possibility of re-identification.

Accountability: The obligation to take responsibility for decisions and demonstrate responsible practices.

Contestability: The ability of affected people to seek explanation, correction, review, or remedy.

Review Questions

Short Answer Questions

1. Distinguish data governance from data management.
2. What is metadata, and why is it important for governance?
3. Explain the difference between privacy and information security.
4. What is the purpose of data minimization?
5. Name the four functions of the NIST AI Risk Management Framework.

Long Answer Questions

1. Explain why data should be treated as a strategic asset while also being subject to ethical and rights-based constraints.
2. Compare DAMA-DMBOK, COBIT, ISO standards, and the NIST AI Risk Management Framework.
3. Discuss how accountability should be distributed across executives, data stewards, engineers, privacy officers, and auditors.
4. Explain why fairness in AI cannot be reduced to a single universal metric.
5. Describe the major stages of a responsible data and AI governance program.

Analytical / Application Questions

1. A retailer wants to combine loyalty-card data, mobile-location data, and publicly available social-media data to predict customer churn. Analyze the proposal using purpose limitation, proportionality, privacy, data quality, and accountability principles.
2. A hospital uses a predictive model to identify patients at risk of readmission, but the model performs less accurately for a minority population. Design a governance response covering investigation, validation, communication, human oversight, and remediation.
3. A multinational organization wants one global policy for generative AI use. Evaluate the advantages and limitations of this approach and propose a governance architecture that balances consistency with jurisdictional and business-unit differences.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes data governance from data management?

A. Governance establishes authority and accountability, while management performs operational and technical activities.

B. Governance is limited to cybersecurity, while management is limited to privacy.

C. Governance concerns only databases, while management concerns only AI models.

D. Governance is performed by vendors, while management is performed by regulators.

Correct Answer: A. Governance establishes authority and accountability, while management performs operational and technical activities.

Question 2

Which principle requires an organization to collect and retain no more personal data than is necessary?

A. Transparency

B. Data minimization

C. Availability

D. Portability

Correct Answer: B. Data minimization

Question 3

What is the primary purpose of metadata?

A. To eliminate the need for data security

B. To replace all personal identifiers

C. To describe data characteristics, origin, structure, and use

D. To guarantee that a model is unbiased

Correct Answer: C. To describe data characteristics, origin, structure, and use

Question 4

Which framework is specifically organized around the functions Govern, Map, Measure, and Manage?

A. DAMA-DMBOK

B. COBIT

C. ISO/IEC 27001

D. NIST AI Risk Management Framework

Correct Answer: D. NIST AI Risk Management Framework

Question 5

Why does encryption alone fail to satisfy privacy governance?

A. Encryption prevents all authorized access.

B. Securely encrypted data may still be collected or used for an unauthorized purpose.

C. Encryption makes data automatically inaccurate.

D. Encryption is relevant only to physical records.

Correct Answer: B. Securely encrypted data may still be collected or used for an unauthorized purpose.

Question 6

What does pseudonymization generally mean?

A. Irreversibly destroying all information about a person

B. Replacing identifiers with codes while retaining a possibility of re-identification

C. Publishing personal data without restriction

D. Converting unstructured data into a database table

Correct Answer: B. Replacing identifiers with codes while retaining a possibility of re-identification

Question 7

In the three-lines model, which group typically provides independent assurance?

A. Business users operating first-line controls

B. External customers

C. Internal audit

D. Data-entry staff

Correct Answer: C. Internal audit

Question 8

Which case most clearly illustrates a data-lineage requirement?

A. Determining the color of a dashboard

B. Tracing how source transactions were transformed into an AI recommendation

C. Choosing an office location

D. Selecting a meeting time

Correct Answer: B. Tracing how source transactions were transformed into an AI recommendation

Question 9

Why can a formally neutral AI model still produce discriminatory outcomes?

A. Neutral models cannot process numerical data.

B. Historical data or proxy variables may encode unequal treatment or protected characteristics.

C. All automated systems are necessarily discriminatory.

D. Fairness requires ignoring all historical data.

Correct Answer: B. Historical data or proxy variables may encode unequal treatment or protected characteristics.

Question 10

Which practice is most appropriate when deploying a high-impact AI system?

A. Deploying it without monitoring after initial testing

B. Relying only on the vendor’s marketing assurance

C. Maintaining documentation, validation, human oversight, monitoring, and appeal mechanisms

D. Removing all human review to preserve efficiency

Correct Answer: C. Maintaining documentation, validation, human oversight, monitoring, and appeal mechanisms