4. Data Protection & Residency

How to control sensitive data in AI prompts, outputs, files, tools, and agent actions — including DLP, classification, residency, retention, and secrets hygiene.

Last reviewed: August 18, 2026

AI tools create data exit points and derived stores that traditional DLP may not see: prompts, tool calls, outputs, embeddings, vector stores, caches, evaluation data, and cross-app artifacts. This section covers how to classify, control, retain, delete, and audit sensitive data across those paths.

Articles in this section

1. 4.1 DLP for GenAI
2. 4.2 Data classification for AI prompts and outputs
3. 4.3 Data residency and regional inference
4. 4.4 Retention and Zero Data Retention
5. 4.5 Training opt-out and data usage
6. 4.6 Cross-app data flow and live artifacts
7. 4.7 Secrets and credential hygiene in prompts and tools

Frequently asked questions

Why doesn't traditional DLP protect against AI data leakage? Traditional DLP can inspect files and traffic on the channels it covers, but AI introduces paths that many deployments do not inspect: pasted prompts, uploads, native desktop clients, API requests, tool calls, connectors, and agent-generated actions. The gap is coverage, not that DLP is inherently unable to recognize sensitive data. Map each AI surface to an enforcement point, then test browser, endpoint, API, and agent paths separately.

What data types are most commonly exposed through AI tools? Prioritize credentials and secrets, source code, customer and employee personal data, financial information, legal and contract material, and internal strategy or product documents. Do not treat this as a universal ranking; exposure patterns depend on the organization, workforce, and tools. Use pilot and production telemetry to tune policies around the data users actually submit.

Does Zero Data Retention mean my data never touches the vendor's infrastructure? Not necessarily. Zero Data Retention generally means eligible customer content is not retained after processing under vendor-specific terms. The data still transits vendor infrastructure, and some endpoints or features may retain application state or be ineligible for ZDR. Metadata, third-party tools and connectors, files, background jobs, and customer-controlled storage can follow different rules. Verify scope by product, endpoint, region, and subprocessor before treating ZDR as a control.

What AI data stores need separate lifecycle controls? Include source documents, uploads, knowledge bases, embeddings, vector stores, fine-tuning and evaluation datasets, provider caches, temporary files, backups, traces, compliance exports, and generated artifacts. Define an owner, region, retention period, access model, deletion path, and verification method for each store.

Related handbook guidance

• AI Security Handbook
• 2.6 AI hooks: inference controls and lifecycle automation
• 5.2 Data exfiltration via tools and connectors
• 6.3 Compliance APIs by platform