A Risk Based Approach for Privacy Compliant Machine Learning Lifecycle

Data Protection and Privacy is a priority focus for each organization, driven by rapidly emerging regulatory requirements around the world. These regulations are generating continuous need of review and adaption across software used by business. Over the past years, usage of Machine Learning for businesses increased significantly. The increase of usage is giving significant advantages to the business with its capabilities of predicting the results, enables the business to prepare for the upcoming challenges. Core principle on which Machine Learning is based on is “Predictions are more accurate when the models can be trainable on huge amounts of data from various sources”. However, the need of processing large amounts of data is also bringing in a concern in terms of Data Privacy. With this paper, we will provide a risk-based approach, following the privacy focused threat modeling to ensure data privacy compliant machine learning lifecycle. Risk based approach advocates “Start Early” to identify potential risk early to plan and mitigate. We will describe in this paper, how risk-based approach can systematically help identifying usage of personal data, data minimization and flow and process implementation required to ensure the machine learning business case is meeting the data privacy regulatory requirement.