Document control
Document ID: 002
Author(s): GRC Team
Version: 1.1
Date: 13/07/2026
Disclaimer:
This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.
Document Details
| Document Title | Artificial Intelligence (AI) Data Protection and Retention Policy | ||||
|---|---|---|---|---|---|
| Document Id | SecureXcel/AIMS/AI-002 | Current Version | 1.0 | Date of Release | 09-Nov-2026 |
| Classification | Internal | Author | GRC & Compliance Team | ||
| Reviewed by | GRC & Compliance Lead | ||||
| Approved by | Management Representative | AI Governance Committee (AIGC) | |||
| Designation |
Revision History
| Version | Date | Author | GRC & Compliance Team | GRC & Compliance Lead | Management Representative |
|---|---|---|---|---|---|
| 1.0 | 22/07/2025 | GRC Lead | GRC Head | AIGC | Initial version |
| 1.1 | 13/07/2026 | GRC Lead | GRC Head | AIGC | Updated section 11 |
1. Introduction
The purpose of this policy is to ensure the protection of data used, processed, and generated by Artificial Intelligence (AI) systems within the organization. This policy establishes guidelines for securing AI-related data, ensuring compliance with ISO 42001:2023 and relevant data protection regulations such as GDPR.
2. Scope
Artificial Intelligence (AI) Data Protection and Retention Policy
- All AI models, algorithms, and automated decision-making systems.
- All employees, contractors, and third-party vendors handling AI data.
- AI-related data collection, processing, storage, and sharing.
- Personally Identifiable Information (PII) and sensitive business data processed by AI tools.
3. AI Data Protection Principles
The organization shall adhere to the following AI data protection principles:
- Data Minimization – Only necessary data will be collected and processed by AI systems.
- Fairness & Transparency – AI data usage must be clear, explainable, and accountable.
- Security & Integrity – AI data must be protected against unauthorized access and breaches.
- Legal Compliance – AI data practices must comply with ISO 42001:2023, GDPR, and other regulations.
- Accountability & Governance – AI data handling must follow approved governance policies.
4. AI Data Classification and Handling
AI data shall be classified based on sensitivity and handled accordingly:
- Public Data – Freely accessible, no restrictions on use.
- Internal Data – Restricted to organizational use, not for public sharing.
- Confidential Data – Sensitive business or AI training data with controlled access.
- Personal Data – Includes PII, subject to strict protection and regulatory compliance.
5. AI Data Collection and Consent
To ensure ethical AI data collection:
- User consent must be obtained before processing personal data.
- AI systems must not collect excessive or irrelevant data.
- Individuals must be informed about AI-driven data processing practices.
- Data collected for AI training must be anonymized where possible.
6. AI Data Storage and Security Measures
To secure AI data, the organization shall:
- Store AI data in encrypted databases with role-based access controls.
- Regularly update AI security policies to address emerging threats.
- Implement AI data lifecycle management, ensuring timely deletion of unused data.
- Use blockchain or other tamper-proof methods for securing AI training data integrity.
7. AI Data Access Control
To prevent unauthorized access, the organization shall:
- Restrict AI system access based on job roles and responsibilities.
- Implement multi-factor authentication for AI data access.
- Log and monitor AI data access activities for security audits.
- Regularly review AI access permissions to prevent privilege misuse.
8. AI Data Anonymization and De-Identification
To protect personal data, AI systems shall:
- Use anonymization techniques before storing sensitive user data.
- Apply differential privacy methods to AI model training datasets.
- Ensure AI-generated insights do not compromise user anonymity.
9. AI Data Sharing and Third-Party Compliance
AI data sharing must follow strict guidelines:
- AI data should only be shared with authorized third parties under strict agreements.
- External vendors must comply with ISO 42001:2023 and data protection regulations.
- Data sharing agreements must specify security measures, purpose limitations, and retention policies.
10. AI Data and Documentation Retention Schedule
This schedule is the organization's single, defined and authoritative reference for how long the organization stores AI data, interaction logs, and system documentation, and satisfies the retention-period requirements of A.5.3, A.7.6, and 7.5.3. It is referenced by, and takes precedence over, any generic mention of "organizational data retention policy" or "records retention schedule" elsewhere in the AIMS document set (including the AIMS Manual Sections 6.2 and 8.1, B-001 Section 3.3.1, and B-007 Section 3.5.1).
Retention timelines are heavily risk-based: the AI System Owner determines the applicable AI system's risk tier from the AI Risk Assessment (6.1.2) and Impact Assessment (B-003), and applies the longer of (a) the period below or (b) any stricter period required by applicable law or contract. Data classified as PII is, in addition, subject to the Data Minimization principle (Section 3) and shall not be kept longer than necessary regardless of the maximum period stated below.
| Data / Documentation Category | Standard Retention Period | High-Risk AI System Retention | Basis |
|---|---|---|---|
| AI training & validation datasets (non-PII) | Life of model + 1 year post-decommissioning | Life of model + 2 years post-decommissioning | Reproducibility, audit trail (A.7.5) |
| AI training data containing PII | Anonymized or deleted within 90 days of model finalization, unless a longer period is legally required | Same, with mandatory DPIA re-review at 90 days (B-001 Section 2.2) | Data minimization; GDPR/DPDPA 2023 |
| Production / inference input-output data | 12 months rolling | 2 years rolling | Incident investigation, model monitoring |
| Interaction logs (user queries, chatbot/agent sessions, model outputs) | 12 months | 2 years | Audit trail, complaint investigation (AIMS-B-004) |
| System / technical event logs (model inference, data pipeline, infrastructure logs) | Minimum 12 months, or the applicable regulatory minimum (e.g., TRAI/DoT), whichever is longer | Minimum 2 years | AIMS Manual Section 8.1; incident investigation and audit |
| AI system documentation (design docs, model cards, V&V/test reports, runbooks) | Life of system + 1 years post-decommissioning | Life of system + 2 years post-decommissioning | Traceability, certification audit evidence (7.5.3) |
| AI System Impact Assessment Reports | Minimum 3 years from date of issue, or 3 years from decommissioning, whichever is longer | Same (B-003 Section 3.10.1) | A.5.3; consistent with B-003 |
| AI Risk Register entries and risk treatment records | Life of the AIMS + 2 years | Life of the AIMS + 2 years | Governance continuity |
| AI security / data breach incident records | Minimum 3 years from closure | Minimum 5 years from closure | Regulatory defensibility, recurrence analysis |
| Consent records (data subject consent for AI processing) | Duration of processing + 2 years after withdrawal or processing ends | Same | DPDPA 2023 accountability requirements |
| Data subject access / erasure request records | 2 years from request closure | 2 years from request closure | Legal defensibility |
| Internal / external AIMS audit records | Minimum 2 years | Minimum 2 years | 9.2, certification maintenance |
Upon expiry of the applicable retention period, data and documentation shall be disposed of per the secure disposal methods defined in B-001 Section 3.3.2 (Secure Disposal Process). The GRC Team reviews this schedule at least annually, and upon any material change to applicable law, as part of the Continual Improvement process (10).
11. AI Data Breach Response and Incident Management
In case of AI data breaches:
- The AI Governance Committee (AIGC) must be notified immediately.
- Affected users and regulatory authorities must be informed per compliance requirements.
- An AI security incident investigation must be conducted.
- Preventive measures must be implemented to mitigate future risks.
12. AI Ethics and Responsible AI Use
To promote responsible AI use:
- AI models must be designed to prevent discriminatory outcomes.
- AI-generated decisions must be explainable and auditable.
- Ethical AI guidelines must be integrated into AI development processes.
- Employees must be trained on AI data ethics and security best practices.
13. Compliance with ISO 42001:2023 and Other Standards
This policy aligns with:
- ISO 42001:2023 (Artificial Intelligence Management System)
- ISO 27001 (Information Security Management)
- ISO 9001 (Quality Management System)
- GDPR and other data protection laws