Domain 3: AI Data Management, Privacy, and Model Security (19% of exam)

Data ownership roles: information owner (accountable for the data's business purpose/risk), steward (manages day-to-day quality/handling), controller (determines purposes/means of processing — a GDPR-flavored term).
Data sovereignty / cross-border residency: legal requirements that data (and sometimes AI processing of it) stay within specific national/regional borders.
Data classification/tagging: labeling data by sensitivity (public, internal, confidential, restricted) so handling rules can be applied automatically; sensitive data impact assessments evaluate consequences if that classified data is exposed or misused by an AI system.
Data provenance/lineage/sourcing: tracking where data came from and every transformation it underwent — including distinguishing real vs. synthetic sourced data (relevant to model collapse risk from Domain 1).
Chain-of-custody: documented, unbroken record of who handled data and when — same forensic concept as physical evidence, applied to datasets.
AI data lifecycle: collection → validation → transformation → retention → archiving → deletion (an expanded version of the 1.4 lifecycle, now with governance/accountability framing).

Privacy by Design principles: consent, purpose limitation (only use data for the stated reason), lawful usage, data minimization (collect only what's needed) — privacy built in from the start, not bolted on later.
Data protection techniques: tokenization, anonymization (removing identifying info), differential privacy (adding statistical noise so individual records can't be reverse-engineered while aggregate patterns remain useful), masking, noise injection.
Global privacy regulations: GDPR (EU, general data protection), HIPAA (US, health data), PCI DSS (payment card data) — know which domain of data each governs.
AI-specific privacy challenges: unintentional bias (model learns correlations that disadvantage groups without being told to), right to erasure (GDPR's "right to be forgotten" — hard to fully honor once data has been baked into trained model weights).

Training data integrity: ensuring the data used to train a model hasn't been tampered with or corrupted.
Data poisoning / backdoors / extraction threats: mitigating the attacks from Domain 1/6 (corrupting data, hidden triggers, reconstructing data from outputs) at the data-handling stage specifically.
Unauthorized label modification: an attacker subtly changes labels in training data (e.g., mislabeling malware as "safe") to corrupt what the model learns — a specific, sneaky form of poisoning.
Malicious datasets: entire datasets crafted or injected specifically to harm a model, vs. legitimate data being tampered with after the fact.
Dataset tampering and versioning: detecting unauthorized changes to a dataset and maintaining version history so you can prove/revert to a known-good state.
Recursive training data security: protecting against model collapse (Domain 1.3) by controlling how much AI-generated content re-enters future training sets; synthetic data trustworthiness = verifying synthetic data is actually representative and not itself corrupted.

DSPM (Data Security Posture Management): tools/practices for continuously discovering and assessing risk across where sensitive data lives and how it flows, including into AI systems.
DLP (Data Loss Prevention) and semantic filtering: traditional DLP watches for sensitive patterns (SSNs, credit cards); semantic filtering on AI inputs/outputs goes further, catching meaning-based leaks (e.g., a paraphrased secret) that pattern-matching alone would miss.
Encryption for data states: in use (data actively being processed — hardest to protect), in transit (moving across networks), at rest (stored) — standard triad, now applied specifically to AI pipelines/model weights.
Key management lifecycle: KMS (centralized key management service), BYOK (Bring Your Own Keys — customer controls their own encryption keys rather than the vendor), secret management, key rotation.
Purpose-based / restricted data access: access controls tied to why data is being accessed, not just who's asking — e.g., an Agentic AI data catalog might only let an agent pull data relevant to its specific authorized task.
Media sanitization on high-density AI storage: cryptographic erasure (destroying the encryption key so data becomes unreadable) and micro-shredding — needed because AI storage (large GPU clusters, specialized drives) can't always be wiped with traditional methods.

Model governance: ownership, risk classification, and approval workflows for each model — mirrors the data governance structure in 3.1, now applied to models themselves.
Model documentation / approved model registries: model cards are the key term — standardized documentation describing a model's intended use, training data, limitations, and performance characteristics. Registries track which models are approved for use.
Model deployment pipeline security: validation, packaging, serving, and credential management as a model moves from development into production.
Input/output sanitization, updates, rollback: operational safeguards applied continuously after deployment, not just at launch.
Security lifecycle monitoring: watching for model drift, bias tracking, and anomaly detection on an ongoing basis post-deployment.
Privacy-preserving audit trails: logging AI data events in a way that supports accountability/forensics without itself exposing sensitive data in the logs.

Supply chain risk assessments: evaluating risk specifically from third-party, open-source, and public datasets used in training or fine-tuning.
Provenance/authenticity verification for vendors: confirming a third-party model or dataset is genuinely what the vendor claims it is (ties to 6.3's pedigree verification).
Foundation/pre-trained model risks: using someone else's base model means inheriting whatever vulnerabilities, biases, or hidden backdoors that base model already has — you don't have full visibility into how it was built.