Data Privacy & AI
Should a startup re-run its privacy analysis every time it points a new feature at held data?
Fractional attorney, Charlotte Corporate Counsel ·
The short answer
Yes, once for every new processing activity. I analyze privacy one processing activity at a time: each feature, model, or training run that puts data you already hold to a new purpose gets its own check. A lawful collection doesn't make the next use lawful. The records can stay exactly the same while the purpose changes, and the purpose decides your role under the GDPR and the CCPA.
Your first analysis covered one purpose, not every use after it
You did the work at launch. You wrote the privacy notice, signed the data processing agreement, and settled your role: a processor under the GDPR, a service provider under the CCPA. That analysis answered one question. May we process this data for this purpose?
When a new feature points a model at the same records, the data hasn't changed, but the purpose has. I think that's the step most startup privacy advice skips. A new purpose can move you from service provider to business, or from processor to controller, for that one activity.
Miss that, and you can end up running a feature under obligations you never took on: more transparency, new contract terms, consumer rights requests, purpose limits, and data governance work. Charlotte Corporate Counsel's guide to analyzing AI under the GDPR and CCPA walks through each of those obligations.
Does that mean a full privacy review for every feature?
No. The framework stays the same, because both laws have always regulated collection and processing. What your AI features change is the facts. So you don't rebuild the analysis. You answer the same questions again, for the new activity only.
Same customer data, new purpose: what changes
Take an analytics startup that sells AI-powered reports to enterprise customers under a service provider agreement. It processes each customer's data for one purpose: generating that customer's reports, under a written contract. Months later, the team wants to train its own large language model on the same data, to improve products for future customers.
Nothing about the records changed. For the training run, though, the startup may now be the one deciding why the data is processed. Under the GDPR, whoever decides the purposes and means is a controller. So the startup has to ask again whether it's still a service provider or processor for that activity, and what new obligations follow.
- Purpose
- The customer's
- Role
- Service provider or processor
- Purpose
- Yours
- Role
- Test it again: possibly business or controller
Your reports feature keeps its original answer. The training run gets its own.
One fact can change the outcome. If you train on anonymized or deidentified data instead, the analysis may look very different, because both laws exclude information that can no longer identify a person.
Four questions to answer before your next feature touches held data
Run these for each feature, model, training run, or workflow. Write the answers down next to your original analysis, so the next person can see what changed.
- What is this activity, and what's its purpose?Say it in one sentence. If it isn't a purpose you've already analyzed, it's a new activity.
- Is the data still personal information?If it can still identify someone, directly or indirectly, both laws still apply. Deidentified or aggregate data may take a different path.
- Who decides the purpose now?If your customer does, you may still be their processor or service provider. If you do, you may be a controller or business for this activity.
- What does that role add?Check your privacy notice, your customer contracts and DPAs, how you handle consumer rights requests, and any purpose limits for this activity.
The data you hold today will feed features you haven't planned yet. Each one gets its own four answers, and your launch analysis stays good for what it covered.
Working on something like this? Tell Charlotte about it.
Read the full argument
The essay sets out the whole GDPR and CCPA framework behind these four questions, from jurisdiction to legal roles.
Analyzing AI privacy obligations one processing activity at a time, not once at collection
Charlotte Lynn Luu
Georgia-licensed attorney and fractional counsel for technology startups and growth-stage businesses, Charlotte Corporate Counsel
Charlotte wrote a startup guide to analyzing AI under the GDPR and CCPA, and works through these role questions with companies that keep pointing new AI features at data they already hold.
