AI data privacy risk checker

Under HIPAA for health data and the GLBA Safeguards Rule for financial data; there's no general federal privacy law:

• A business associate agreement for PHI. A vendor may receive protected health information only under a written business associate agreement that sets its permitted uses and bars any other, model training included; a cloud provider needs one even if it only stores encrypted data without the key. (45 CFR 164.502(e), 164.504(e); HHS, HIPAA and cloud computing)
• A contract for financial customer data. A financial institution under the FTC must vet any service provider given customer information and bind it by contract to keep safeguards. (16 CFR 314.4)
• Breach deadlines. A breach of unsecured PHI is notified to the people affected within 60 days of its discovery; an FTC-regulated financial institution reports one involving 500 or more consumers to the FTC within 30 days. (45 CFR 164.404; 16 CFR 314.4)
• Penalties. HIPAA civil penalties run to $73,011 per violation, and $2,190,294 for uncorrected wilful neglect. (45 CFR 102.3)
• A promise not to train is enforceable. The FTC treats an AI provider's promise not to train on customer data as binding: breaking it, or quietly changing the terms, can be unfair or deceptive. (FTC on AI privacy commitments)

Under PIPEDA, and Quebec's private sector act for Quebec:

• You stay accountable. An organisation stays responsible for personal information it sends to a third party for processing, and must secure comparable protection by contract. (PIPEDA)
• Health and income records. Medical and income records are almost always sensitive, needing stronger consent and safeguards. (PIPEDA)
• Leaving Quebec. A Quebec business completes a privacy impact assessment and signs a written agreement before personal information goes to a provider outside Quebec; penal fines reach $25 million or 4% of worldwide turnover. (Québec private sector act)
• Breaches and fines. A breach with a real risk of significant harm is reported to the Privacy Commissioner and the people affected as soon as feasible; PIPEDA fines reach $100,000. (PIPEDA)
• What the regulators expect of generative AI. Enter sensitive information only where you're authorised to, and make sure prompts aren't kept or reused for purposes such as training. (OPC generative AI principles)

Under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025:

• A processor contract. Using any processor, an AI vendor included, needs a written contract with the Article 28 terms: instructions, confidentiality, security, sub-processors, deletion and audits. (ICO processor contracts)
• Training makes the vendor a controller. The ICO's view is that a provider that uses your prompts to improve its own models is a controller for that, not your processor, so the disclosure needs its own lawful basis. (ICO on generative AI controllership)
• Health data. Health data needs an Article 9 condition, for care by or under a professional bound by confidentiality; financial data isn't special category data. (ICO on special category data)
• Sending data abroad. A provider outside the UK means a restricted transfer: UK adequacy (US companies certified to the UK Extension of the Data Privacy Framework count), an IDTA or the Addendum. (ICO on transfers)
• Breaches and fines. A notifiable breach is reported to the ICO within 72 hours; fines reach £17.5 million or 4% of worldwide turnover. (ICO breach guide)

Under the GDPR and the Bundesdatenschutzgesetz:

• A processor contract. A cloud AI provider needs an Article 28 contract, and the data protection authorities advise choosing services that don't train on your inputs. (GDPR; DSK guidance on AI)
• Health data. Health data is a special category: processing needs an Article 9 condition and, for care, people bound by secrecy with safeguards such as access limits, logging and encryption. (GDPR; § 22 BDSG)
• Professional secrecy. Doctors, lawyers, tax advisers and insurers may share secrets with a service provider only as far as its service needs, and commit an offence if they don't oblige it to secrecy. (§ 203 StGB)
• Health data in the cloud. In the statutory health system, health data may be processed in the cloud only in Germany, the EU or an adequate country, by a provider with a German establishment and a current BSI C5 attestation. (§ 393 SGB V)
• Sending data to the US. The EU-US Data Privacy Framework stands after the General Court upheld it on 3 September 2025, so certified US providers can receive data without other safeguards. (Latombe judgment)
• Breaches and fines. A breach is reported to the authority within 72 hours; fines reach €20 million or 4% of worldwide turnover. (GDPR)

Under the Digital Personal Data Protection Act 2023, whose core duties apply from 13 May 2027:

• A processor contract. From 13 May 2027 a Data Fiduciary may use a processor only under a valid contract with security safeguards, and stays responsible for what it does. (DPDP Act 2023; DPDP commencement; DPDP Rules 2025)
• Payment data stays in India. All payment system data must be stored only in India; it can be processed abroad if it's deleted there within one business day or 24 hours. (RBI payment data storage)
• Sending data abroad. Transfers abroad are allowed unless the government restricts a country, and stricter sector rules still apply. (DPDP Act 2023)
• Breaches and fines. From 13 May 2027 a breach is reported to the Data Protection Board in detail within 72 hours; the top penalty is ₹250 crore. (DPDP Act 2023; DPDP Rules 2025)

Under the Personal Data Protection Act 2012:

• Sending data abroad. Personal data sent overseas must get protection comparable to the PDPA's, by law, contract or binding rules. (PDPA 2012)
• Banks and the cloud. MAS treats cloud services as outsourcing: a bank assesses the risk before customer information goes to an overseas provider. (MAS outsourcing guidelines)
• Breaches and fines. A notifiable breach is reported to the PDPC within 3 calendar days of assessing it; fines reach 10% of Singapore turnover above S$10 million, otherwise S$1 million. (PDPA 2012)

Under the Data Privacy Act of 2012:

• Sensitive personal information. Health, genetic and government-issued ID information is sensitive; processing it is prohibited unless an exception such as specific consent applies. (Data Privacy Act 2012)
• You stay accountable. The controller stays accountable for personal information it transfers, at home or abroad, and must protect it by contract. (Data Privacy Act 2012)
• Banks and the public cloud. Banks may use public cloud only for non-core work that doesn't directly involve sensitive customer data. (BSP Circular 808)
• Breaches. A personal data breach is reported to the National Privacy Commission and the people affected within 72 hours, with the full report to the Commission within 5 days. (NPC Circular 16-03)

Under the Personal Data Protection Act 2010, as amended in 2024:

• Processors and transfers. Since 1 April 2025 processors must meet the Security Principle themselves, and data may go abroad to places with substantially similar law or adequate protection. (PDPA amendments 2024)
• Banks and the cloud. A financial institution consults Bank Negara Malaysia before its first use of public cloud for critical systems. (BNM RMiT)
• Breaches and fines. Since 1 June 2025 a breach is notified to the Commissioner within 72 hours and to the people affected within 7 days; the general penalty is up to RM1 million. (PDPA amendments 2024; PDP breach notification guideline)

Under the federal data protection law, with the DIFC's and ADGM's own laws in those free zones:

• Sending data abroad. Under the federal law, personal data may go to a country with data protection law in cases the UAE Data Office approves, or elsewhere under a contract binding the recipient to the law's standards. Controllers have six months from the law's executive regulations to comply, and the federal legislation portal lists none so far. (UAE PDPL (English))
• Bank data stays in the UAE. Banks keep customer data in the UAE, and sharing it abroad needs the central bank's approval and the customer's written consent. (CBUAE outsourcing regulation)
• AI in the DIFC. DIFC firms deploying AI give a clear notice at first use, and high-risk processing through AI waits for the Commissioner's certification requirements. (DIFC Regulation 10)
• ADGM. ADGM firms report breaches within 72 hours where feasible, send data out only under an adequacy decision or other safeguards, and face fines up to USD 28 million. (ADGM Data Protection Regulations)

Under the Privacy Act 1988 and its Australian Privacy Principles:

• Don't use public AI tools for personal information. As a matter of best practice, the OAIC recommends not entering personal information, and particularly sensitive information, into publicly available generative AI tools. (OAIC guidance on AI products)
• You answer for the overseas provider. An entity that discloses personal information to an overseas recipient is accountable for that recipient's breaches of the Privacy Principles. (Privacy Act 1988)
• My Health Record data stays in Australia. Records held for the My Health Record system must not be held, processed or handled outside Australia. (My Health Records Act, s. 77)
• Regulated financial firms. Banks, insurers and super trustees cover information held by third parties and report material security incidents to APRA within 72 hours. (APRA CPS 234)
• Penalties. A serious interference with privacy can draw the greatest of $50 million, three times the benefit or 30% of adjusted turnover. (Privacy Act 1988)

Under your country's privacy law:

• Check four things. Whether a vendor processing personal data needs a written contract, whether health or financial data may leave the country, how fast a breach must be reported, and what the regulator has said about AI tools.