Principles for responsible, trustworthy and privacy-protective generative AI technologies
Developers and providers of generative AI, and organizations using it in public-facing or internal work, including those further training a model for their own purposes.
This is general information, not legal advice.
Status: Published December 7, 2023 by the federal Privacy Commissioner with provincial and territorial privacy authorities; still listed on the federal Commissioner's AI page on 2026-11-08.
What to check
- Know and document your legal authority for handling personal information across the system's lifecycle, with valid and meaningful consent where consent is the basis. Source
- Avoid inappropriate uses such as unfair or discriminatory profiling. Source
- Show that using generative AI and personal information is necessary and proportionate, using anonymized, synthetic or de-identified data where possible. Source
- Tell people what is collected and why, and disclose when AI is involved in decisions. Source
- Stay accountable for AI-supported decisions through governance and privacy impact assessments, and give people a way to challenge decisions. Source
- Give people access to and correction of their information, including where it may appear in model outputs. Source
- Remember that publicly available data still carries privacy obligations, and collect only what you need. Source
- Check outputs for accuracy, especially those affecting individuals, and guard against threats such as prompt injection and jailbreaking. Source