Plain answer

What evidence should we keep for AI privacy?

Keep the system register, the data and provenance record, the impact assessment, the supplier terms, the logs and their retention, the incident route and the review minutes. The evidence should be readable by an auditor and by an affected person.

The register

One entry per AI system: purpose, the personal data it touches, the lifecycle stages the organization controls, the role it plays, the supplier and the owner. This is the document every other control attaches to.

The assessment

The impact assessment with its date, author, approver, the groups considered, the harms identified, the decision and the review trigger. An assessment that cannot be found did not happen.

The data and the supplier

The acquisition record and the provenance for each dataset, the minimisation decision for each field, and the contract terms for each AI supplier including retention, subprocessors, model change notice and deletion on exit.

Operation and review

The monitoring thresholds, the event logs and their retention, the incident communication plan, the external concern route, the internal audit result and the management review minute that considered the AI privacy indicators.