Data Usage, Training Rights and Confidentiality Clauses

Introduction

When an organization adopts an AI system, especially one delivered by a third-party vendor such as a large language model (LLM) API, a SaaS copilot or a managed machine learning platform, the organization's data begins to flow outside its direct control. The contract that governs this relationship is one of the most powerful risk controls a security manager has. Within the ISACA Advanced in AI Security Management (AAISM) body of knowledge, under the domain of AI Risk Management for Security, the topic of Data Usage, Training Rights and Confidentiality Clauses addresses exactly this: how contractual language determines what a vendor may do with your data, whether it can be used to train or improve models, and how it must be protected and kept confidential.

This guide explains why the topic matters, what each type of clause means, how these clauses operate in practice, and how to approach exam questions on the subject with the ISACA mindset.

Why This Topic Is Important

1. Data leakage through model training. If a vendor is permitted to use customer prompts, uploaded documents, embeddings or fine-tuning datasets to train or improve its models, sensitive information may be memorized and later regurgitated to other customers. Several well-publicized incidents involved employees pasting source code or confidential plans into public AI tools whose default terms allowed training on inputs.

2. Regulatory and legal exposure. Privacy laws such as the GDPR, CCPA/CPRA, HIPAA and sector-specific regulations require that personal data be processed only for specified purposes and under appropriate safeguards. A vendor training on personal data without a lawful basis or without a compliant data processing agreement can expose the customer organization, not just the vendor, to fines and litigation.

3. Intellectual property and trade secrets. Proprietary data, algorithms and business logic lose trade-secret protection if they are disclosed without confidentiality obligations. Unclear ownership of fine-tuned models or generated outputs can create disputes over who holds the IP.

4. Supply chain and fourth-party risk. AI vendors frequently rely on subprocessors, foundation model providers and cloud hosts. Without clauses that flow obligations down the chain, confidentiality can evaporate at the second or third hop.

5. Accountability. ISACA's governance philosophy holds that outsourcing a function does not outsource accountability. The organization remains accountable for its data, so the contract must create enforceable obligations and verifiable assurance.

6. Shadow AI. Employees adopting consumer-grade AI tools under click-through terms bypass contract review entirely. Understanding what standard terms permit helps the security manager design acceptable use policies and technical controls.

What It Is: Defining the Three Clause Types

Data Usage Clauses
These define the purposes for which the vendor may process customer data and the limits on that processing. Key elements include:
- Purpose limitation: data may be used only to deliver the contracted service.
- Scope of data: definition of what counts as customer data (prompts, inputs, outputs, logs, metadata, embeddings, fine-tuning data, feedback).
- Retention and deletion: how long data is kept, whether there is a zero-data-retention option, and verified deletion upon termination.
- Data residency and localization: where data is stored and processed geographically.
- Logging and monitoring: whether the vendor retains prompts for abuse monitoring, for how long, and who can access them.
- Aggregation and anonymization: whether the vendor may derive statistics or de-identified data, and under what standard of de-identification.
- Subprocessor usage: notification, approval and flow-down requirements.

Training Rights Clauses
These address whether the vendor may use customer data to train, fine-tune, evaluate, benchmark or otherwise improve its models or services. Key elements include:
- Explicit prohibition or opt-in versus default opt-out: enterprise agreements typically prohibit training on customer data by default; consumer terms often permit it unless the user opts out.
- Definition of training: should cover pre-training, fine-tuning, reinforcement learning from human feedback (RLHF), evaluation sets, and red-teaming datasets.
- Human review: whether vendor staff or contractors may view prompts to label data or review flagged content.
- Derived models: who owns a model fine-tuned on customer data, and whether the vendor may reuse it for other customers.
- Model improvement carve-outs: watch for language permitting use for 'service improvement', 'quality assurance' or 'research' that can function as a back door to training.
- Output ownership and license: whether the customer owns generated outputs and whether the vendor may reuse them.

Confidentiality Clauses
These impose the duty to protect information from unauthorized disclosure. Key elements include:
- Definition of confidential information, ensuring that AI inputs, outputs, fine-tuned weights and system prompts are included.
- Standard of care: typically no less than the vendor applies to its own confidential information and at minimum reasonable industry practices, often tied to certifications such as ISO/IEC 27001, SOC 2 or ISO/IEC 42001.
- Permitted disclosures: to employees and subprocessors on a need-to-know basis bound by equivalent obligations.
- Legal compulsion: notification before disclosure under subpoena where lawful.
- Duration: survival of confidentiality obligations after contract termination, ideally indefinitely for trade secrets.
- Breach notification: timelines (for example 24 to 72 hours), content of notice, and cooperation duties.
- Security controls: encryption in transit and at rest, access controls, tenant isolation, logging, and independent audit or assessment rights.
- Remedies: indemnification, liability caps and carve-outs for confidentiality breaches, and injunctive relief.

How It Works in Practice

Step 1: Classify the data before it reaches the AI system. The organization's data classification scheme drives what can be shared with which vendor under which terms. Highly restricted data may be prohibited from any external AI service regardless of contract terms.

Step 2: Perform vendor due diligence. Review the vendor's published terms, data processing addendum (DPA), security documentation, model cards, subprocessor list and independent assurance reports. Identify whether the vendor distinguishes between consumer, API and enterprise tiers, because training rights usually differ by tier.

Step 3: Negotiate and document. The security manager works with legal, procurement and privacy to ensure that the master services agreement, DPA and any AI-specific addendum contain: no-training-by-default language, purpose limitation, retention limits, confidentiality coverage of AI artifacts, subprocessor flow-down, audit rights, breach notification, and termination deletion certification.

Step 4: Translate contract into configuration. Many AI platforms offer settings such as opt-out of training, zero-data-retention, regional endpoints and disabled history. The contract and the configuration must match. A clause is only as effective as the technical setting that enforces it.

Step 5: Implement compensating controls. Data loss prevention, prompt filtering, redaction or tokenization of personal data before submission, private or on-premises model deployment for sensitive workloads, and enterprise gateways that route all AI traffic through monitored channels.

Step 6: Monitor and assure. Periodically review vendor terms for unilateral changes, obtain updated assurance reports, exercise audit rights where justified, and include AI vendors in the third-party risk management review cycle. Track metrics such as the percentage of AI vendors with approved training-rights language.

Step 7: Manage termination. Ensure return or verified deletion of data, fine-tuned models, embeddings and logs, and confirm that confidentiality obligations survive.

Common Red Flags in AI Contracts
- Broad licenses granting the vendor a perpetual, irrevocable, worldwide right to use customer content.
- 'Service improvement' or 'research' purposes with no exclusion of model training.
- Human review of prompts without notice or without confidentiality binding.
- Silence on output ownership or on fine-tuned model ownership.
- Retention of prompts for 30 days or more with no option to reduce.
- Confidentiality definitions limited to data marked as confidential, which rarely happens with API calls.
- Liability caps that make confidentiality breaches economically meaningless.
- Unilateral right to modify terms with notice only by posting on a website.

The Security Manager's Role
In AAISM, the candidate is expected to think like a manager, not a lawyer or an engineer. The security manager:
- Ensures AI risk assessment includes contractual review of data usage and training rights.
- Advises on risk treatment options: accept, mitigate through clauses and controls, transfer through indemnity or insurance, or avoid by selecting another vendor or deployment model.
- Aligns contract requirements with organizational risk appetite, data classification and regulatory obligations.
- Maintains an inventory of AI systems and the terms under which each processes data.
- Escalates residual risk to senior management and the AI governance body for informed acceptance.
- Coordinates with legal, privacy, procurement and business owners rather than acting alone.

How to Answer Exam Questions on This Topic

ISACA exam questions are scenario-based and usually ask for the best, most important, first or primary action or concern. Several options may be plausible; one aligns most closely with governance and risk-management principles.

Exam Tips: Answering Questions on Data Usage, Training Rights and Confidentiality Clauses

1. Governance before technology. If a question asks what should be done first before adopting a third-party AI service, favor answers involving risk assessment, data classification and contract review over deploying a technical tool. Controls follow requirements.

2. Accountability cannot be outsourced. Any answer implying that a vendor contract transfers accountability for data protection to the vendor is wrong. Contracts transfer responsibility and some financial risk, never accountability.

3. Default to prohibiting training unless explicitly approved. When a scenario describes sensitive or personal data flowing to an AI vendor, the best answer typically requires an explicit contractual prohibition on using customer data for model training, backed by a verified technical opt-out.

4. Watch for the 'contract versus configuration' gap. If a scenario states that the contract prohibits training but the platform default still allows it, the right answer addresses verifying and enforcing the configuration, because a clause without enforcement is an unmitigated risk.

5. Purpose limitation is the anchor. Questions about data usage usually resolve to whether processing is restricted to delivering the contracted service. Broad licenses and vague improvement language are the risk.

6. Confidentiality must cover AI artifacts. If a question highlights that prompts, outputs or fine-tuned models are not covered by the confidentiality definition, the best answer is to amend the definition, not to rely on general goodwill or a security certification alone.

7. Flow-down to subprocessors. When a vendor relies on a foundation model provider, the correct answer ensures obligations flow down contractually and that the subprocessor list is disclosed, rather than simply trusting the primary vendor.

8. Risk-based, not absolute. Avoid answers that ban all AI use or demand on-premises deployment for every case. ISACA favors proportionate responses aligned with data classification and risk appetite. Private deployment is correct when the data is highly sensitive and the vendor refuses adequate terms.

9. Involve the right stakeholders. Correct answers often reference collaboration with legal, privacy and procurement. The security manager advises and verifies; legal negotiates; the business owner accepts residual risk.

10. Prefer verification over assertion. Answers involving independent assurance reports, audit rights, deletion certificates and periodic review of terms outrank answers relying on vendor marketing statements or verbal assurances.

11. Address shadow AI through policy plus controls. If employees are using consumer AI tools, the best answer combines an acceptable use policy, awareness training and technical controls such as an enterprise gateway or approved alternative, rather than only disciplining users or only blocking a URL.

12. Read the qualifier carefully. 'Greatest risk' questions point to data leakage through training or unauthorized disclosure. 'First step' questions point to inventory, classification or risk assessment. 'Most effective control' questions point to the enforceable contractual clause combined with technical enforcement. 'Primary responsibility of the security manager' questions point to ensuring risks are identified, assessed and communicated, not to drafting legal text.

13. Eliminate extremes and technical minutiae. Options that are purely technical (for example, choosing an encryption algorithm) or purely legal (for example, selecting governing law) are rarely the best answer in a management-level exam when a governance or risk option is present.

14. Termination and survival matter. Questions about ending a vendor relationship test whether you remember deletion of data and derived models, return of confidential information, and survival of confidentiality clauses.

Worked Example 1
A business unit wants to use a cloud-based generative AI service to summarize customer support tickets that contain personal data. The vendor's standard terms allow use of inputs to improve its services. What should the information security manager recommend FIRST?
Plausible options might include deploying a DLP tool, negotiating an enterprise agreement that prohibits training on customer data, conducting a privacy impact assessment, or blocking the service. The best answer is to perform a risk assessment including review of data classification and contractual terms, because this establishes whether and under what conditions the use is acceptable. If the options do not include a risk assessment, negotiating an enterprise agreement with a training prohibition and a compliant DPA would be the strongest control-focused answer.

Worked Example 2
An AI vendor contract prohibits training on customer data, but an audit finds that the organization's API account still has data sharing for model improvement enabled. What is the MOST significant concern?
The concern is that the contractual control is not being enforced technically, meaning sensitive data may already have been used for training. The correct action is to disable the setting immediately, assess what data was exposed, and strengthen the process that reconciles contractual requirements with configuration.

Worked Example 3
Which of the following BEST ensures confidentiality of proprietary data used to fine-tune a vendor-hosted model?
Candidates might see options such as vendor ISO certification, encryption at rest, a clause defining fine-tuning data and resulting model weights as the customer's confidential information with restricted use, or employee awareness training. The best answer is the contractual clause explicitly defining the artifacts as confidential and restricting their use, because it creates the enforceable obligation that the other measures support.

Key Terms to Remember
- Zero data retention: vendor does not store prompts or outputs beyond the duration of the request.
- Opt-out versus opt-in training: who bears the burden of acting to prevent or permit training.
- Data Processing Agreement (DPA): the privacy-law-driven addendum defining roles, purposes, security measures and subprocessors.
- Flow-down: requiring subprocessors to be bound by equivalent obligations.
- Survival clause: obligations that continue after termination.
- Derived data and derived models: outputs, embeddings and fine-tuned weights created from customer data.
- Purpose limitation: processing only for specified, explicit and legitimate purposes.

Summary

Data usage, training rights and confidentiality clauses are the contractual backbone of AI third-party risk management. They determine whether your data stays yours, whether it can be absorbed into a vendor's models, and how it must be protected and eventually destroyed. For the AAISM exam, remember the ISACA mindset: assess risk first, align with classification and appetite, require explicit and enforceable terms, verify that configuration matches contract, flow obligations down the supply chain, retain accountability, and collaborate with legal, privacy and procurement. When choosing among answers, prefer the governance-oriented, risk-based, verifiable option over purely technical, purely legal, or extreme responses.