Why existing privacy law still governs AI, and the data protection principles that apply across the life cycle
The starting rule of AI-and-privacy law is simple: any privacy law that would govern a process still governs it when an AI system performs it. AI changes the scale and the failure modes, not the applicability.
Why this matters for the AIGP exam
This framing sentence is the lens for the whole first stretch of Domain II. Scenarios test whether you notice that an "AI question" is really a privacy question that existing law already answers.
The essentials
- Applicability follows the data, not the technology. If personal data is collected, used, shared or retained, privacy law applies — whether the processor is a spreadsheet or a model.
- The principles travel across the AI life cycle. Collection limitation, purpose specification, use limitation, data quality, security, transparency, individual participation and accountability apply at every stage, from training-data acquisition to model retirement.
- Training data is where AI strains the principles. Web-scraped corpora sit awkwardly against collection limitation and purpose specification; model retention sits awkwardly against storage limitation and deletion rights.
- The GDPR is the reference law most scenarios reach for, but the same analysis runs under US state laws (CCPA/CPRA and successors) and other national regimes.
- Enforcement did not wait for AI law. Privacy regulators have acted against AI systems under existing authority — including ordering the deletion of models trained on unlawfully collected data.
What the exam asks
Spot the privacy law hiding in an AI scenario, name the principle a described practice violates, and remember that "we used AI" is never a defence to a data protection obligation.
Going deeper
This page is the condensed version. The full topic — with the detail above expanded and practice questions attached — is in the app, inside Domain II. Domain I, a quarter of the course, is free to try first.
Back to the AIGP study guide.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.