Privacy Laws Applied to AI
AIGP privacy-law questions cover transparency, choice, lawful basis, purpose limitation, minimization, privacy by design, controller obligations, processors, transfers, data subject rights, automated decision making, incidents, records, and sensitive data.
How to study for IAPP AIGP
Treat each question as a governance decision: identify the AI role and life-cycle stage, classify the legal or risk issue, then choose the control, evidence, and accountability path.
Core concepts
Concept 1
AI systems can trigger privacy obligations around notice, choice, lawful basis, purpose limitation, data minimization, and privacy by design.
Exam cue: Use purpose limitation when data collected for one purpose is proposed for AI training or inference.
Concept 2
Controller obligations may include impact assessments, processor oversight, cross-border transfer controls, rights handling, automated decision requirements, breach notification, and record keeping.
Exam cue: Use processor oversight when a vendor handles personal data for an AI workflow.
Concept 3
Sensitive or special-category data such as biometric information requires heightened controls and careful justification.
Exam cue: Use impact assessment and automated-decision review when AI could materially affect people.
Risk pitfalls and guardrails
Assuming public or available data is automatically free for AI training.
Guardrail: Avoid treating vendor tools as risk-free, relying on aggregate accuracy alone, or stopping governance after deployment approval.
Ignoring data subject rights when AI outputs affect individuals.
Guardrail: Avoid treating vendor tools as risk-free, relying on aggregate accuracy alone, or stopping governance after deployment approval.
Treating biometric data as ordinary business data.
Guardrail: Avoid treating vendor tools as risk-free, relying on aggregate accuracy alone, or stopping governance after deployment approval.
Memory anchors
Lawful Basis
Lawful basis is the legal justification for processing personal data.
Purpose Limitation
Purpose limitation restricts data use to compatible or authorized purposes.
Data Minimization
Data minimization limits data collection and use to what is necessary.
Privacy by Design
Privacy by design embeds privacy protections into system planning and operation.
Processor Oversight
Processor oversight manages vendors or service providers that process personal data.
Data Subject Right
A data subject right lets individuals access, correct, delete, object, or exercise other legal rights.
Automated Decision
An automated decision uses automated processing to make or support decisions about people.
Sensitive Data
Sensitive data receives heightened protection because misuse can create greater harm.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
Under the GDPR, what does Article 22 address that is highly relevant to AI?
What is a data protection impact assessment (DPIA) in relation to AI?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”