Where Does Your Data Go? Data Privacy and Confidentiality in GxP AI

What is actually at stake

The concern is rarely personal data in the GDPR sense, though that applies in clinical contexts. For most validation and quality use cases the exposure is commercial and regulatory:

• Product and process information. A URS for a manufacturing system describes how you make your product. A deviation investigation describes what went wrong. This is competitively sensitive material.
• Pre-approval information. Documents relating to a product not yet filed or approved carry disclosure risk of a different order.
• Regulatory correspondence and findings. Inspection observations and responses are among the most sensitive documents a company holds.
• Personal data. Trial subject data under GCP, and employee data in training and signature records.
• Third-party confidential information. A CDMO or CRO handling client material is usually contractually barred from disclosing it to a subprocessor without consent — and passing it to an AI service may be exactly that.

That last point catches organisations out. The obligation may not be yours to waive.

The five questions that produce a real answer

1. Where is the content processed?

Not where the vendor is headquartered — where the computation happens. Ask for named regions, and ask whether processing can fail over to another region under load. A commitment that content stays within a stated jurisdiction is meaningful; a general statement about global infrastructure is not.

2. Is the content retained, and for how long?

There is a meaningful difference between content processed and immediately discarded, content cached briefly for performance, and content stored indefinitely. Ask for the retention period in days, and ask what is retained — the full document, a derived representation, or only metadata.

3. Is your content used to train or improve models?

Ask it directly and get it in writing. Note that vendors sometimes distinguish between training a model and using content for "service improvement" or "quality monitoring" — which can mean human review of your documents. Ask about both. For most regulated use cases the required answer is no to both, with a contractual commitment rather than a settings toggle that a future default could change.

4. Who can see it?

Within the vendor: which roles have access to customer content, under what circumstances, with what logging. "Support staff can access customer data to troubleshoot" is a normal answer, but it should come with access controls, approval, and an audit record you can request.

5. Who else is involved?

Subprocessors. If the vendor builds on infrastructure or model services from another party, your content reaches that party. You need the list, notification of changes to it, and confidence that the vendor's commitments flow down. Ask for the subprocessor register as a document, not a verbal summary.

Deployment models and what each actually means

• Multi-tenant cloud. Your content is processed on shared infrastructure with logical separation. Acceptable for most use cases with the right contractual terms — and the most common arrangement by far. The controls to verify are tenant isolation, encryption in transit and at rest, and access logging.
• Single-tenant or dedicated. Dedicated infrastructure for your organisation. Reduces isolation concerns at higher cost. Confirm what "dedicated" covers — application, database, model inference — because it often does not cover all three.
• Private deployment in your environment. The system runs in infrastructure you control. Strongest position on data exposure, and a genuine requirement for some organisations. It transfers operational burden to you, including the qualification of the underlying infrastructure.
• Air-gapped. No external connectivity. Occasionally required. Verify what functionality is lost, since some capabilities depend on external services.

There is no universally correct choice. The correct choice is the one your risk assessment justifies for the content involved — see GxP risk assessment. Applying air-gapped requirements to low-sensitivity documentation work is a common way to stall an adoption programme for no risk reduction.

Practical controls on your side

• Classify before you connect. Decide which document categories may be processed by which system, and enforce it in configuration rather than in a procedure people are asked to remember.
• Start with lower-sensitivity content. Template and procedure drafting proves the capability without exposing pre-approval material. Widen scope as evidence accumulates — the approach in running a 90-day GxP AI pilot.
• Log what was sent. Your audit trail should record which content was processed by which system and when. You will need this if a question arises later, and it is also part of the validation evidence.
• Check third-party obligations first. If you handle client material under contract, confirm you are permitted to process it externally before you evaluate tools, not after.
• Review at renewal. Terms change. A commitment obtained two years ago should be reconfirmed, along with the subprocessor list.

The vendor-side version of this assessment sits inside qualifying an AI vendor, and inspectors will ask about processing location and training use directly — see question 11 in what inspectors ask about AI.