AI & Data Privacy Compliance
The most actively enforced rules governing AI today are privacy laws, and every AI system that touches information about people sits inside them. This course maps the landscape as of August 2026, from GDPR and the US state privacy laws to California's automated decision-making rules and the sensitive data categories. You'll learn to apply lawful basis, minimization, transparency, individual rights, and risk assessments to real AI work. You'll finish able to run the daily practices of a privacy-safe AI program, from the data map and prompt hygiene to vendor contracts and breach response.
Course details
Duration
1h 00m 43s
Lectures
16
Video
1 hour
Quizzes
1
Level
Beginner
Course Description
Personal data meets AI at three points: training, prompts, and outputs. Privacy law already governs all three, and regulators are enforcing it now. This course teaches the principles that hold while statutes shift, dates the specifics that move, and turns both into habits that prevent the most common exposure: one convenient paste.
What you'll learn
- How GDPR, the US state privacy laws, and California's ADMT rules apply to AI
- Sensitive data, inference, and why training is a one-way door
- Lawful basis, purpose limitation, minimization, and anonymizing before prompting
- AI-aware privacy notices, individual rights, human review, and risk assessments
- The AI data map, the never-in-a-prompt list, and training data governance
- Vendor DPAs and no-training clauses, breach response, and a privacy-safe AI program
Who it's for
Privacy, compliance, and legal staff, IT and data teams, managers, and any employee whose AI use touches customer or employee data.
16 short video lessons in three modules: The Privacy-AI Landscape; Privacy Principles Applied to AI; and Operating Privacy-Safe AI.
This course is educational and is not legal advice. Your organization's privacy and security policies and qualified counsel govern specific decisions.
Module 1: The Privacy-AI Landscape
-
1.1 Where Privacy Law Meets AIWhy AI use is a privacy-law event — and who's enforcing it.
In this lesson:
- Explain why AI use is a privacy event
- Name the three data exposure points
- Recognize privacy regulators as the most active AI enforcers
-
1.2 GDPR & AI
Lawful basis, the legitimate-interest test, and the deletion problem.
In this lesson:
- Explain why GDPR applies in full to AI
- Describe the legitimate-interest test for training data
- Recognize the trained-model deletion problem
-
1.3 The US State Privacy Family
~24 state laws, one common core — and how it touches AI.
In this lesson:
- Describe the state privacy family's common core
- Distinguish controller and processor duties
- Apply the family's AI-relevant rights
-
1.4 California's ADMT Rules
The live US rules for automated decision-making technology.
In this lesson:
- Define ADMT and the significant-decision list
- Name the live obligations: notices, opt-outs, access, assessments
- State the compliance timeline as of August 2026
-
1.5 Sensitive Data & Special Categories
Health, biometric, financial, and children's data under heightened AI rules.
In this lesson:
- Identify the sensitive data categories
- Explain the heightened rules in AI contexts
- Apply the keep-it-out safe posture
Module 2: Privacy Principles Applied to AI
-
2.1 Lawful Basis & Purpose Limitation
Every AI use of personal data needs a justification — and stays in its lane.
In this lesson:
- Identify a lawful basis for each AI processing
- Apply purpose limitation to data reuse for AI
- Document basis decisions
-
2.2 Data Minimization & Anonymization
Less data in, less risk out — and what “anonymous” really requires.
In this lesson:
- Apply minimum-necessary data to AI workflows
- Distinguish anonymization from pseudonymization
- Run the anonymize-before-prompting routine
-
2.3 Transparency & Privacy Notices
Telling people about AI processing — plainly, and where the law requires.
In this lesson:
- Update privacy notices for AI processing
- Apply layered and pre-use notice practice
- Write plain-language AI data descriptions
-
2.4 Individual Rights in AI Systems
Access, deletion, opt-out, and human review — reaching into AI systems.
In this lesson:
- Apply access and deletion rights to prompts, logs, and models
- Honor opt-out and human-review rights
- Build rights handling that reaches AI systems
-
2.5 AI Privacy Risk Assessments
When assessments are required, what they contain, and keeping them audit-ready.
In this lesson:
- Recognize when a privacy risk assessment is required
- Draft the assessment's four sections
- Keep assessments current and audit-ready
Module 3: Operating Privacy-Safe AI
-
3.1 The AI Data Map
Inventorying every personal-data flow through every AI use.
In this lesson:
- Build a data map of AI personal-data flows
- Capture the map's five fields
- Find the shadow flows nobody documented
-
3.2 Prompts, Outputs & Daily Practice
The employee-level hygiene that prevents most AI privacy exposure.
In this lesson:
- Apply the never-in-a-prompt list
- Handle outputs containing personal data
- Run the think-before-you-prompt screen
-
3.3 Training Data Governance
Provenance, scraping rules, opt-outs, and fine-tuning on customer data.
In this lesson:
- Establish provenance for training data
- Apply the scraping rules in practice
- Gate fine-tuning on customer data
-
3.4 Processors, Vendors & DPAs
AI tools as data processors — the contract baseline that protects you.
In this lesson:
- Treat AI vendors as data processors
- Require the DPA baseline and the no-training clause
- Maintain subprocessor visibility
-
3.5 AI Privacy Incidents & Breach Response
When AI exposure becomes a breach — clocks, counsel, and the sequence.
In this lesson:
- Recognize when AI exposure is a privacy breach
- Run the response sequence with notification clocks
- Know when counsel leads
-
3.6 The Privacy-Safe AI Program
Assembling the pieces into one living program — the course finale.
In this lesson:
- Assemble the six program components
- Train the workforce as a program requirement
- Complete the AI & Data Privacy Compliance course
AI & Data Privacy Compliance — Final Exam
Learn at your own pace
Study the materials at your convenience, you can always return to them to repeat
Certificate of completion
Complete every lesson and pass the final exam to earn a RiseCert certificate of completion you can download and share.
Your Name
AI & Data Privacy Compliance
RISECERT
CERTIFICATE
For demonstrated knowledge and successful completion of all course requirements for:
MM.DD.YYYY
Certificate Date
Ready to get started?
Enroll in AI & Data Privacy Compliance and earn your RiseCert certificate of completion.
Got Questions? We've Got Answers!
Answers to the most common questions about this course.
What is the AI & Data Privacy Compliance course?
AI & Data Privacy Compliance is a RiseCert online course on how privacy law applies to AI: where personal data meets AI, the principles regulators enforce, and the daily practices that keep AI use privacy-safe. It includes 16 video lessons (about an hour in total) and a final exam.
Who should take an AI privacy compliance course?
Privacy, compliance, and legal staff; IT, security, and data teams; managers who approve AI tools; and any employee whose AI use touches customer or employee data. The course is written at an awareness and practice level, so no legal background is required, though privacy professionals will find it a structured map of AI-specific issues.
Does GDPR apply to AI?
Yes. As the course explains, European data authorities have confirmed GDPR applies to AI in full, with no carve-out, and reaches any organization processing EU residents' data. Every AI processing of personal data needs a lawful basis, publicly available data is still protected, and sensitive data in training faces a near-prohibition.
What is ADMT under California's privacy rules?
ADMT, or automated decision-making technology, is technology that processes personal information and uses computation to replace or substantially replace human decision-making. In the course's August 2026 summary, California's rules took effect January 1, 2026 and require pre-use notice, opt-out, access, and risk assessments for significant decisions such as lending, housing, education, employment, and health care.
What is the difference between anonymized and pseudonymized data?
Anonymized data means identification is no longer reasonably possible by anyone, which takes it outside privacy law's scope. Pseudonymized data has identifiers replaced, such as names becoming codes, but a key exists, so it remains personal data and the law fully applies. The course calls confusing the two one of privacy's most consequential mistakes.
Can employees paste customer data into AI tools?
Not identified records. The course teaches a never list: identified customer or employee records, sensitive categories, credentials, and confidential data outside approved tools. Before any real-data prompt, a ten-second screen asks who is identifiable, what is sensitive, and where the data is going, and most tasks work just as well after anonymizing.
What should a data-processing agreement with an AI vendor include?
The course's DPA baseline covers processing only on your instructions, security matching the data's sensitivity, deletion and disclosure on demand, prompt breach notice, and return and deletion at exit. For AI vendors, the critical added term is a no-training clause, plus visibility into subprocessors with notice of changes and your terms flowing down.
What should happen if personal data is pasted into an unapproved AI tool?
The course treats it as a potential privacy breach and teaches a sequence: contain, scope, assess, notify, and remediate. Notification clocks generally start at discovery, with GDPR's benchmark at 72 hours, so counsel engages as soon as exposure is suspected. The data map makes scoping a matter of hours rather than weeks.
Do I need a legal or privacy background?
No. The course teaches principles first and explains each legal concept in plain terms, from lawful basis to controller and processor roles. It's built for working professionals who use or oversee AI, not only lawyers. When a specific compliance decision arises, the course is clear that qualified counsel makes the call.
What will I be able to do after completing the course?
You'll be able to identify the three data exposure points, apply lawful basis and purpose limitation, anonymize before prompting, close AI gaps in privacy notices, route rights requests to AI stores, draft a four-section risk assessment, build an AI data map, gate training data, review vendor DPAs, and run breach response.
Is the course content up to date?
The course states moving facts with a date, as of August 2026, including roughly 24 US state privacy laws and California's ADMT compliance dates. Privacy law moves fast, so the course teaches durable principles first and builds in a habit of re-verifying specifics against current sources before relying on them for real decisions.
How long does AI & Data Privacy Compliance take?
The course has about an hour of video across 16 lessons, plus a final exam. Lessons run about four minutes each and are organized into three modules: The Privacy-AI Landscape; Privacy Principles Applied to AI; and Operating Privacy-Safe AI. Many learners finish in one or two sittings.
Is the course online and self-paced?
Yes. The course is 100% online and self-paced, and your access does not expire. You can start, pause, and resume at any time on a computer, tablet, or phone with a modern web browser. There's nothing to install.
Is there a final exam?
Yes. The course ends with a 30-question multiple-choice final exam covering all three modules. You need a score of 80% or higher (24 of 30) to pass, and you can retake the exam as many times as you need. Finish all 16 lessons and pass the exam to complete the course.
Do I get a certificate of completion?
Yes. After you complete all 16 lessons and pass the final exam, you can download a RiseCert certificate of completion. It is a course completion certificate, not a license, professional privacy certification, or continuing education (CE) certificate, and it does not establish compliance for you or your organization.
Does the course count for continuing education or privacy certification credit?
No. AI & Data Privacy Compliance is not currently approved or accredited for continuing education (CE, CPE, or CEU) credit by any state, licensing body, or privacy certification organization. It is practical awareness training, and the certificate records course completion only.
Is this course legal advice?
No. The course is educational, at an awareness level, and is not legal, compliance, or security-consulting advice. It summarizes privacy rules at principle level as of August 2026. Your organization's privacy and security policies, your privacy officer, and qualified counsel govern specific compliance decisions.
Is the course approved or endorsed by a privacy regulator?
No. AI & Data Privacy Compliance is an independent RiseCert training course and is not endorsed, approved, or reviewed by any data protection authority or regulator. Completing it shows you finished the training; it does not certify that an organization's AI use complies with GDPR, state privacy laws, or California's rules.
How much does the course cost, and can I enroll my team?
The course costs $99 per learner as a one-time purchase, with no subscription or recurring fees. To enroll a team, department, or whole workforce, contact RiseCert through the Contact Us page at risecert.org.
What is the refund policy?
All sales are final and no refunds are issued, as stated in the RiseCert Terms of Use. Please review the course description, lesson list, and these FAQs before purchasing, and contact RiseCert with any questions first.