# DAT-09 Consent for AI processing

Domain: DAT Data Protection & Privacy · HI-AAF v1.3 · Public review · https://humanintel.net/standard/dat/dat-09

Consent for AI processing is captured from end users and customers where required by law or contract.

Where law or contract requires consent for AI processing, consent is captured from end users and customers before the agent processes their data. Consent records are tracked per data subject and respected at the prompt and retrieval layers: an agent cannot process data for a subject who has not consented or who has withdrawn consent.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for DAT-09: Consent capture mechanisms are operational; consent records are tracked per data subject; consent withdrawal is honored in real time at the prompt and retrieval layers; compliance is audited.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Consent capture mechanisms are operational.
- Consent records are tracked per data subject.
- Consent withdrawal is honored in real time at the prompt and retrieval layers.
- Compliance is audited.

## Framework mappings

- ISO/IEC 42001: A.7.3
- SOC 2 (TSC): P1.1, P2.1
- EU AI Act: Art. 10(5)
- Singapore: PDPA s.13, PDPA s.14, MAIGF Data, AI Verify Data Governance

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Cite this control

Human Intelligence. HI-AAF v1.3, DAT-09 Consent for AI processing. Public review edition, July 2026. https://humanintel.net/standard/dat/dat-09