Where We Are In 2026
GDPR, CCPA, the EU AI Act, and a growing patchwork of US state AI laws create real privacy obligations for any company deploying AI. Enforcement actions have started. Founders who treat this as “legal's problem” accumulate liability.
Map Your Data Flows
Document every place customer data flows: what data, where it goes, how long it's retained, who can access it. AI vendors are a new addition to most flow maps and many founders haven't updated them.
Vendor Due Diligence
Every AI vendor in your stack needs:
- A signed DPA (data processing agreement) or BAA where applicable.
- No-training opt-out (in writing).
- Sub-processor list (who do they share with?).
- Breach notification commitment.
- SOC 2 Type II (for B2B).
Consent and Disclosure
Disclose AI use to customers and users. The bar in 2026: privacy policy mentions AI, terms of service explain the model providers (or categories), relevant UI moments disclose AI involvement.
- • Data flow map current?
- • All vendors have current DPAs?
- • Privacy policy reflects current AI use?
- • Retention schedules followed?
- • Subject access requests processed in time?
Data Minimization
The most overlooked principle: only send the AI provider the data they need. Strip PII before AI calls when possible. Mask names, addresses, identifiers unless the use case requires them.
Incident Response
Pre-plan: who declares an AI privacy incident, who notifies regulators, who notifies customers, what's the timeline. Most jurisdictions require 72-hour notification on serious breaches.
Specific Frameworks
- GDPR (EU customers): Article 22 (automated decisions), DPA, retention.
- CCPA/CPRA (CA): consumer rights, opt-out of sale, sensitive data.
- EU AI Act: risk classification, transparency, prohibited uses.
- HIPAA (healthcare): BAA, PHI handling.
- GLBA (financial): customer information safeguards.
Privacy in AI isn't a checklist you complete once. It's a discipline you maintain. The founders who build the discipline now spend less on compliance crisis-management later.
See AI security basics.
FAQ
Do we need a DPO? Required by GDPR if processing certain categories at scale. Otherwise advisable.
Privacy tool? Helpful at scale. Manual works under ~30 vendors.
Cookies? Separate compliance regime. Don't conflate.