Data Privacy & AI
Is one privacy assessment at collection enough for a product adding new features?
Fractional Attorney, Charlotte Corporate Counsel ·
The short answer
No. A privacy assessment at collection covers the purposes you had when you collected the data. Each new feature, model, or training run that uses the same personal information can be a new processing activity under the GDPR and the CCPA. I analyze compliance one processing activity at a time, because a lawful collection doesn't make the next use lawful. The full framework is in my guide to processing-activity privacy analysis.
What breaks when a new feature runs on an old assessment?
Your privacy notice, your data processing agreement, and the role you claimed in customer contracts were all written for the purpose you had at collection. When a feature points that data at something new, those documents may stop describing what you actually do. The data sits in the same tables. The legal picture around it has moved.
That gap can bring obligations you haven't planned for: more transparency, new contract terms, consumer rights, purpose limitation questions, or data governance work. Each AI feature, model, training activity, or workflow may carry its own purpose. So each one gets its own look.
You often find out when an enterprise customer sends a DPA or an AI addendum with the deal and asks what you do with their data. That question is far easier to answer before you ship than while the deal waits on it.
Same data, new purpose: how one feature can change your role
Here's the example I use. A startup sells AI-powered analytics to enterprise customers under a service provider agreement. It processes customer data only to generate reports for that customer, as the contract says. Months later, it wants to train its own large language model on the same data to improve products for future customers.
Same customer data in both
The information hasn't changed. The purpose has. For that training activity, the startup may need to reassess whether it's still a service provider or processor, and whether more obligations apply under the CCPA or the GDPR.
One detail can flip the answer. If the startup trains on deidentified or anonymized information instead, the analysis may come out differently, because both laws exclude information that can no longer identify a person. So you always ask what the data is, as well as what you're doing with it.
Four questions to ask before a new feature touches data you already hold
Run them per feature, per model, and per training run. When the answers match your existing assessment, you can move on. When they don't, you've found the activity that needs a closer look.
What is this feature doing with the data?
Write the purpose in one sentence. Compare it to the purpose in your notice and your contracts. A different purpose means a new processing activity.
Is it still personal information?
Both laws cover data that can directly or indirectly identify a person. Deidentified or aggregate data can change the analysis.
What's your role for this one activity?
If you decide the purpose and means yourself, as with training your own model, you may be a controller or business here. That can be true even where you're a processor or service provider for everything else.
What does that role require that you don't have yet?
Check your privacy notice, your DPA, and your customer contracts against the new purpose. Look for gaps in transparency, contract terms, consumer rights, purpose limitation, and data governance.
Working on something like this? Tell Charlotte about it
Written for founders
Want the whole framework, start to finish?
My guide walks through which data the GDPR and the CCPA regulate, which role your startup plays under each, and how AI features change both answers.
Charlotte Lynn Luu
Fractional Attorney for Technology Start Ups and Growth Stage Businesses, Charlotte Corporate Counsel
Charlotte wrote Charlotte Corporate Counsel's startup guide to analyzing AI under the GDPR and CCPA, and she works through these role questions with companies pointing new AI features at data they already hold.
She is a Georgia-licensed attorney and practiced at Baker Hostetler, Baker Donelson, and Kutak Rock before launching her own practice.
