Insight for counsel · AI and privacy
What Evidence Shows Whether AI Processed Personal Data?
A policy statement or vendor description does not establish what an AI system processed in a particular matter. The analysis must trace the relevant data from collection or input through transmission, storage, model use, output and deletion.
Written by Leonardus “Leo” Herps · Published 19 October 2026
Build the data-flow record
- What personal data was submitted, generated or inferred?
- Which user, system or integration supplied it?
- Which provider, model and account configuration processed it?
- Where was it stored or processed?
- Who could access it, and for how long?
- Was it retained, logged, reused or deleted?
Evidence counsel should request
- AI tool configuration and administrative settings
- Prompt, input, output and access logs
- Vendor terms, data-processing agreements and subprocessor lists
- Retention, deletion and model-training settings
- Identity, permission and sharing records
- Network, region and cross-border transfer information
Match the allegation to technical reality
The presence of personal information in a business workflow does not prove that every downstream model received it or retained it. Conversely, a policy against sensitive inputs does not prove the data was never submitted. The opinion should identify what the evidence demonstrates and what remains unknown.
How Leo can help
Leo combines software, AI, cybersecurity, privacy and regulated-operator experience with legal training. He can map the system, test vendor and party representations and explain whether the alleged GDPR, residency or unauthorized-processing account matches the technical record.
Public sources
Engagement-specific evidence is reviewed under appropriate confidentiality and scope controls.
For counsel
Discuss the technical record.
Engagements are subject to conflicts and scope review. Initial enquiries are treated as confidential.
Contact Leo Herps ↗