RAIDP03-BP03 Protect the privacy of individuals represented in your datasets

Translate the guidance of your legal counsel into a taxonomy of personal data types. For example, define the string patterns for direct identifiers (like names and addresses), quasi-identifiers (like age and zip code), and other attributes (like health conditions and financial status) relevant to your domain.

Implement multi-layered privacy filtering processes combining automated detection, data obfuscation, and manual review. For instance, use regex patterns and named entity recognition to flag potential personal information, and then apply techniques like tokenization, masking, or synthetic data replacement.

Create test datasets with deliberately inserted personal information to evaluate privacy criteria while preserving data utility.

Balance privacy protection with system and evaluation needs by verifying that your privacy measures don't compromise your system's ability to address your use case or your ability to test release criteria. For instance, verify that anonymization techniques maintain demographic diversity needed for fairness assessments.

Document privacy protection decisions and create audit trails of what information gets filtered, obfuscated, or retained.