Privacy & Confidentiality

https://taxonomy.eticas.ai/risk/privacy-confidentiality

Maturity: established

The risk that an AI system collects, processes, or infers personal information in ways that infringe on individuals’ rights to control their data (privacy), or that sensitive information is exposed, accessed, or shared without authorization (confidentiality). This includes risks from data leakage, re-identification, unauthorized use, or insufficient safeguards. On the confidentiality side the category covers confidential information the system holds or is given - in particular customer, partner or third-party data entrusted under contract, NDA or similar terms of use; confidentiality as a general security property of the system (authentication, credential handling, endpoint hardening) is not a privacy risk and is not covered here.

Also known as: Privacy · Data Privacy

System type: ADM and LLM systems
Lifecycle stages: Pre Processing, In Processing, Post Processing

Risk groups

• Data collection & use — Risks from how personal data, and data entrusted to the system under terms of use, is obtained, processed and repurposed.
• Data protection — Risks from how stored personal data, and data entrusted to the system under terms of use, is retained, erased and accessed, and whether anonymized personal data stays anonymous.
• Model-level privacy — Risks from the model exposing personal or confidential information through its outputs.

Mappings to external frameworks

Status. Each mapping shows what it rests on. Reviewed means a reviewer has confirmed the mapping against the concept’s current definition and the framework edition the taxonomy currently references; when the only confirmation is that of the person who wrote the mapping, it reads Reviewed (author’s confirmation). Outdated means it was reviewed, but the concept’s definition has changed since, so the review has to be repeated. The other statuses mean that no review has been recorded yet. Inherited mappings have been in the taxonomy since before v5.7.0 and are unchanged. They carry no record of who made them or how, and some were checked by hand when the taxonomy first published its mappings. Agent-proposed mappings come from a review carried out by AI agents, which read the framework’s text and the concept’s definition and agreed on the relation; no person has confirmed them yet. Provisional mappings were made without access to the framework’s text. Unreviewed mappings are older mappings whose target or relation was revised in v5.7.0, and any other mapping without a review. Mappings to a superseded edition of a framework are not shown: where the provision continues, they are carried to the current edition. Mappings a review has changed or rejected are not shown.

Standards & frameworks

Taxonomies & vocabularies