# DAT-03 PII handling at runtime

Domain: DAT Data Protection & Privacy · HI-AAF v1.3 · Public review · https://humanintel.net/standard/dat/dat-03

PII handling is enforced at runtime per policy: detection, classification, redaction, or blocking as defined for each agent and context.

Personally identifiable information is detected in inputs and outputs through documented techniques and handled per the organization's data classification policy: detection, classification, redaction, or blocking depending on the agent's authorization and the context. PII that should not be retained is redacted from logs, memory, and any downstream artifact.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for DAT-03: PII detection is active on all input and output paths; handling rules are documented per context; detection accuracy is measured; PII is verified absent from logs and artifacts where retention is not justified.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- PII detection is active on all input and output paths.
- Handling rules are documented per context.
- Detection accuracy is measured.
- PII is verified absent from logs and artifacts where retention is not justified.

## Framework mappings

- ISO/IEC 42001: A.7.3
- SOC 2 (TSC): P3.1, P4.1
- EU AI Act: Art. 10(2)
- Singapore: PDPA s.24, MAIGF Data, AI Verify Data Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by OUT-03 PII and secrets leakage prevention: https://humanintel.net/standard/out/out-03

## Cite this control

Human Intelligence. HI-AAF v1.3, DAT-03 PII handling at runtime. Public review edition, July 2026. https://humanintel.net/standard/dat/dat-03