Responsible Data & Ethics Playbook (Privacy, Protection, Responsible Use)

Privacy is about complying with law and consent terms for handling personal data — retention limits, access controls, breach notification. Ethics covers the broader question of whether a use is fair and appropriate even when it's fully legal, such as a biased model or a use the data subject wouldn't expect. You need both, and ethics is the harder, less codified half.

Counsel owns the legal-compliance quadrant of the Compass and should sit on the Data Ethics Council, but they shouldn't own the whole program — fairness and transparency judgments need business and data practitioners in the room too, since counsel alone can't assess a model's real-world bias.

The core framework applies to both, but model-building teams need the additional half-day bias and fairness deep-dive, because a biased model can cause harm at a scale a single bad report never could. Treat AI/ML use cases as automatically high-risk on the inventory.

No — this playbook assumes that regulatory training already exists and is current. It fills the much larger gray zone above the legal floor: uses that are technically permitted but ethically questionable, which formal compliance training rarely addresses.

Refresh the policy document annually at minimum, and immediately whenever a new data source, vendor, or AI use case is introduced. The Purpose Test itself is durable and rarely needs to change; what changes is the list of real examples used to teach it.