When an artificial intelligence (AI) solution talks with your customers or reads your documents, it processes people's data. In Colombia, that data is protected by Law 1581 of 2012, the personal data protection law. This post is a general, educational guide, not legal advice. For your specific case, consult a lawyer.
What personal data is
It is any information that can identify a person or relates to them: name, ID number, email, phone, address, and also what someone writes in a conversation with a chatbot if it can be linked to that person. Some data is sensitive, such as health data. That calls for extra care.
The principles to keep in mind
- Purpose. Collect data for a clear, disclosed purpose, and use it only for that.
- Authorization. In general, you need the person's prior consent to process their data.
- Freedom and transparency. The person must be able to know what data you hold about them and why.
- Restricted access and circulation. Only those who need it should see the information.
- Security. Data must be protected against loss, improper access or unauthorized use.
- Confidentiality. Those who handle the data must keep it confidential.
Where data shows up in an AI solution
It helps to walk through the path the information takes:
- Input. What data the solution receives: messages, documents, forms.
- Processing. Where it is processed and whether it leaves your control for third-party services.
- Storage. What is kept, for how long and who can view it.
- Output. What the solution shows and to whom. A reply should not reveal another person's data.
- Deletion. How information is erased when it is no longer needed or when someone asks.
Good practices when designing the solution
- Collect only what is needed. If the task doesn't need a piece of data, don't ask for it.
- Inform clearly. Tell people they are talking to an automated assistant and how their data is handled.
- Define permissions. An AI solution should access only the information it needs for its role.
- Separate environments. Use fictitious data in tests, not real customer information.
- Review providers. If you use an external AI service, find out what it does with the data you send and what its terms say.
- Log usage. Keeping a record of who accesses what and what was done helps investigate any incident.
- Plan for people's rights. Data subjects can ask to know, update, correct or delete their data, or to withdraw their authorization. Your solution must be able to handle those requests.
The data processing policy
The law requires organizations that process personal data to have a visible processing policy and a channel for handling inquiries and complaints. If you add AI, check that the policy is still accurate: does it mention the new uses of the data? Does it say which third parties receive it?
What AI doesn't solve on its own
Technology helps, but compliance also depends on processes and people: who authorizes, who answers requests, who reviews incidents. Someone in your organization should take on that responsibility.
How we approach it at ParqueSoft Crea
When we build an AI solution, we discuss from the start what data it touches, where it is processed and who has access, and we document it along with the design. The final legal review of your case is up to your legal advisor.
If you're evaluating an assistant for customer service, read What a language model can and can't do in customer service.
Facing a similar challenge? Get a quote
