AI compliance and data protection overlap but are not the same exercise. A model may satisfy an internal performance test and still fail because the organisation cannot explain the lawful basis, data source, retention period, purpose limitation or route for an affected person to challenge an outcome.
Map the data journey
Document collection, enrichment, training, inference, storage, sharing and deletion. Identify personal data, special-category data, inferred attributes and supplier access. Data minimisation should be tested against the actual decision purpose rather than assumed because a feature is statistically useful.
Automated decision controls
Where decisions have significant effects, define the role of automation, information given to the person, human intervention and appeal. Human review should be competent and capable of changing the result. Record reasons, evidence and outcomes so complaints can be investigated.
Run a DPIA where appropriate
A data-protection impact assessment should connect processing risks to mitigations, owners and residual risk. It should be updated when the model, supplier, purpose or data changes. Privacy notices must be consistent with actual system behaviour, not generic marketing language.
Consult the ICO AI and data-protection guidance. This article is a control framework, not a substitute for jurisdiction-specific legal advice.