Full Article
This is an engineering reading of the Digital Personal Data Protection Act 2023, not legal advice. Get your own counsel before relying on any of it.
Why it changes AI architecture specifically
The Act governs the processing of digital personal data. An AI system that ingests customer records, employee files, support transcripts or scanned identity documents is processing personal data, and the obligations attach regardless of whether a model is involved.
The obligations that change design
- Notice and consent. Processing generally requires consent obtained through clear, itemised notice, or must fall within a legitimate use. "We fed it to a model" is not a purpose - the purpose must be specific and stated.
- Purpose limitation. Data collected for one purpose cannot be silently repurposed as training data. This is the clause most likely to be breached accidentally.
- Data minimisation. Retrieval systems that index everything by default sit awkwardly against this. Scope the corpus deliberately.
- Erasure. A Data Principal can request deletion. If personal data has been embedded into a vector index or baked into fine-tuning weights, deletion is an architectural problem you must solve before you have it, not after.
- Accuracy. Where data is used to make decisions affecting a person, it must be accurate and complete.
- Sub-processors. A Data Fiduciary remains accountable for processors it engages. A third-party model API is a processor.
- Breach notification to the Board and affected Data Principals.
- Grievance redressal. A reachable, published mechanism.
Design consequences
Four things follow directly. Keep a data-classification map per system so you know what is personal and where it sits. Log every access to personal data. Make deletion a first-class operation across every store including indexes and caches, not a manual database query. And enumerate every sub-processor by name, because you will be asked.
The deletion requirement is the one that most often forces a redesign after the fact. Solve it at design time.
Tags
