NIST AI 600-1 GAI-RISK-04Data Privacy

Impacts due to leakage and unauthorized use, disclosure, or de-anonymization of biometric, health, location, or other personally identifiable information or sensitive data.NIST Generative AI Profile, July 2024 (NIST AI 600-1), GAI-RISK-04

We read each law below as bearing on this control. That does not mean the control, done well, meets the law: what each law asks is on its own page. Law library as of 14 Nov 2026.

The kinds of duty that reach it: DPIA, age verification, biometric, breach notice, consent, data subject rights, retention, security, transfer.

32: laws
23: jurisdictions
1: with court rulings behind it
9: not yet in force
8: proposed, not law

Related controls in other frameworks the same duties, in at least two laws we track, reach both

NIST AI RMFMAP 5.1 Likelihood and magnitude of each identified impact (both potentially..., 10 laws
NIST AI RMFMEASURE 2.10 Privacy risk of the AI system – as identified in the MAP function – is..., 8 laws
NIST AI RMFMANAGE 1.3 Responses to the AI risks deemed high priority, as identified by the MAP..., 5 laws
11 more in the NIST AI RMF
NIST AI 200-22.4 Synthesize & Interrogate, 14 laws
NIST AI 200-24.3 Composing a TEVV Toolbox, 8 laws
NIST AI 200-22.3 Apply & Measure, 5 laws
1 more in the NIST AI 200-2
OWASP LLM Top 10LLM03:2026 Excessive Agency, 5 laws
OWASP LLM Top 10LLM01:2026 Prompt Injection, 4 laws
OWASP LLM Top 10LLM02:2026 Sensitive Information Disclosure, 4 laws
2 more in the OWASP LLM Top 10
OWASP Agentic Top 10ASI09 Human-Agent Trust Exploitation, 5 laws
OWASP Agentic Top 10ASI01 Agent Goal Hijack, 4 laws
OWASP Agentic Top 10ASI03 Identity and Privilege Abuse, 4 laws
1 more in the OWASP Agentic Top 10
MIT mitigations3.1 Testing & Auditing, 18 laws
MIT mitigations1.2 Risk Management, 17 laws
MIT mitigations3.2 Data Governance, 16 laws
10 more in the MIT mitigations
NIST Privacy FrameworkCT.PO-P1 Policies, processes, and procedures for authorizing data processing (e.g.,..., 6 laws
NIST Privacy FrameworkCM.AW-P1 Mechanisms (e.g., notices, internal or public reports) for communicating..., 5 laws
NIST Privacy FrameworkCT.DM-P10 Stakeholder privacy preferences are included in algorithmic design..., 3 laws
NIST CSF 2.0PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and..., 2 laws
FINOS AIGFAIR-PREV-005 System Acceptance Testing, 17 laws
FINOS AIGFAIR-PREV-006 Data Quality & Classification/Sensitivity, 11 laws
FINOS AIGFAIR-DET-021 Agent Decision Audit and Explainability, 11 laws
10 more in the FINOS AIGF
ETSI EN 304 2235.1.3-1 Threat modelling and risk management, reviewed regularly and covering..., 18 laws
ETSI EN 304 2235.1.2-1 Business need and security risks written down and assessed before deciding..., 14 laws
ETSI EN 304 2235.1.4-3 Where oversight is a risk control, the technical measures behind it are..., 5 laws
10 more in the ETSI EN 304 223

A law in force is unmarked; the rest wear their state: not yet in force proposed

AI risk obligations

11 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this control
California	CCPA Automated Decisionmaking Technology Regulations	Through its data subject rights duty. What it requires
European Union	AI Act, Article 14 (human oversight) from 2 Dec 2027, in 13 months	Through its biometric duty. What it requires
European Union	AI Act, Article 15 (accuracy, robustness and cybersecurity) from 2 Dec 2027, in 13 months	Through its security duty. What it requires
European Union	AI Act, Article 26(10) (post-remote biometric identification authorisation) from 2 Dec 2027, in 13 months	Through its biometric duty. What it requires
European Union	AI Act, Article 27 (fundamental rights impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
European Union	AI Act, Article 86 (right to explanation of individual decision-making) from 2 Dec 2027, in 13 months	Through its data subject rights duty. What it requires
Italy	Codice Penale Art. 437-bis, Omitted Safety Measures in High-Risk AI Systems and Unlawful Alteration of Them	Through its security duty. What it requires
Italy	Decreto Legislativo 160/2026, After-the-Fact Facial Recognition Integrated in Video Surveillance (Art. 10)	Through its DPIA, biometric duties. What it requires
Kyrgyzstan	Digital Code, Chapter 23: AI system design and risk-management obligations	Through its DPIA duty. What it requires
New Jersey	AI-based electronic monitoring and automated employment decision systems in employment and public services (S4075 / A4981) proposed	Through its DPIA duty. What it requires

Show the other 1 law

Vietnam

Law on Artificial Intelligence, incident management and reporting obligation

Through its breach notice duty. What it requires

AI governance

7 laws, 7 jurisdictions

Jurisdiction	Law	How it reaches this control
Andorra	Council of Europe Framework Convention on Artificial Intelligence, signed by Andorra proposed	Through its DPIA duty. What it requires
Armenia	Council of Europe Framework Convention on Artificial Intelligence, signed by Armenia proposed	Through its DPIA duty. What it requires
Canada	Council of Europe Framework Convention on Artificial Intelligence, signed by Canada proposed	Through its DPIA duty. What it requires
El Salvador	Ley de Fomento a la Inteligencia Artificial y Tecnologías, marco institucional, registro y evaluación de riesgos	Through its DPIA duty. What it requires
European Union	AI Act, Article 26(9) (using Article 13 information for a data protection impact assessment) from 2 Dec 2027, in 13 months	Through its DPIA duty. What it requires
Moldova	Council of Europe Framework Convention on Artificial Intelligence, signed by Moldova proposed	Through its DPIA duty. What it requires
United Kingdom	Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom proposed	Through its DPIA duty. What it requires

AI sector rules

6 laws, 6 jurisdictions

Jurisdiction	Law	How it reaches this control
Colorado	HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions	Through its consent duty. What it requires
Croatia	Consumer Credit Act, Articles 24 and 30, Personalised Offers and Creditworthiness Assessment by Automated Processing from 20 Nov 2026, in 6 days	Through its data subject rights duty. What it requires
European Union	MiFID II Algorithmic Trading Controls: Resilient Systems, Testing, Kill Functionality, Records and Notification (Article 17 and RTS 6)	Through its security duty. What it requires
Illinois	Wellness and Oversight for Psychological Resources Act	Through its consent duty. What it requires
Mauritius	FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services	Through its DPIA duty. What it requires
Sweden	Consumer Credit Act (2026:1011), Chapter 2 Section 7 and Chapter 3 Section 15, Personalised Offers and Credit Assessment by Automated Processing from 20 Nov 2026, in 6 days	Through its data subject rights duty. What it requires

AI prohibited practices

4 laws, 4 jurisdictions

Jurisdiction	Law	How it reaches this control
Florida	Promotion of an Altered Sexual Depiction; Brooke's Law platform takedown duty	Through its data subject rights duty. What it requires
Italy	Decreto Legislativo 160/2026, Police Biometric AI: Dataset Labelling and Real-Time Remote Identification (Artt. 7-9, 13)	Through its DPIA, biometric duties. What it requires
Michigan	Leading Ethical AI Development for Kids Act (Senate Bill 760, as passed by the Senate) proposed	Through its consent duty. What it requires
Utah	Digital Voyeurism Prevention Act (HB 276, 2026 General Session), Utah Code Title 13 Chapter 72b from 1 Jan 2027, in 7 weeks	Through its consent duty. What it requires

AI transparency

2 laws, 2 jurisdictions

Jurisdiction	Law	How it reaches this control
Illinois	Artificial Intelligence Video Interview Act	Through its consent duty. What it requires
New York City	Chatbot Data Privacy, Security, and Transparency proposed	Through its consent, security duties. What it requires

AI training data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Hungary	Act XLVII of 1997 on Health Data, Section 35/A(4) to (8), Conditions for AI Development on Electronic Health Service Space Data	Through its DPIA duty. What it requires

Personal data

1 law, 1 jurisdiction

Jurisdiction	Law	How it reaches this control
Central African Republic	Loi n° 24.001 portant protection des données à caractère personnel, collecte de données publiquement accessibles et transfert transfrontalier	Through its biometric, consent duties. What it requires

Full text of the NIST Generative AI Profile, public domain (a US government work). Every control of the framework.