Privacy & Data Protection Basics

Training data frequently includes personal information, which raises privacy obligations that go beyond ordinary data storage concerns, because the model itself, not just the original dataset, can end up carrying information about specific individuals.

Especially with very large models trained on enormous datasets, it is possible for a model to memorize specific, rare pieces of training data closely enough that this information can later be extracted from the model itself, not just from the original dataset it was trained on. This means "we deleted the original data" is not automatically the same as "no personal information is now exposed" once a model has already been trained on it.

• -Data minimization means collecting and retaining only the personal data actually needed for the task, rather than everything available just in case.
• -Anonymization or pseudonymization means removing or replacing directly identifying information before it is used for training, though this is genuinely harder to do robustly than it sounds, since combinations of "anonymous" attributes can sometimes still identify a specific individual.
• -Consent and purpose limitation mean using personal data only for the purposes a user actually agreed to, not silently repurposing it for something new.
• -Right to deletion means that some regulations require the ability to remove a specific individual's data, and increasingly its influence on already-trained models, upon request.