Picture a support agent pasting a customer’s details into a chatbot to draft a quicker reply. That text hits an LLM, drags in retrieved context, gets embedded in a vector store, lands in agent memory, then heads out through some tool to a third-party service. All before the privacy team has finished updating its inventory.
Figure 1. One prompt, eight stops. Every box is somewhere personal data can sit.
Here’s the new problem. Personal data used to sit in systems a company had inventoried, more or less. It doesn’t any more. It moves through prompts and model contexts, through retrieval layers and vector stores, into agent tools, memory, logs, outside AI apps, and workflows somebody automated last Tuesday that nobody wrote down.
“Where is our personal data?” isn’t the hard question anymore. Try this one instead:
The new enterprise question
“What personal data is our AI estate processing? Where did it come from, and where did it go? What did the AI make out of it, and where does that live now? Who, or what, can get to it? And can we prove and act on that whole journey?”
This piece sets out how Consiva answers it, at enterprise scale. Nobody has to tear out their firewalls, DLP, CASB, SIEM, AI gateways or app controls. Consiva sits on top as a privacy intelligence layer, taking the signals those tools already emit and turning scattered telemetry into context, lineage, risk and evidence.
1. Blocking AI isn’t governing AI
The usual first move when staff start using generative AI everywhere? Block the public tools. Sometimes that’s the right call. But it answers none of the privacy questions, and those are the ones that end up on the DPO’s desk.
- People route around blocks. Personal accounts, a different AI app, a browser extension, their phone on mobile data.
- And the AI tools you did approve still process sensitive data. Through prompts, retrieval-augmented generation (RAG), agent tools, memory.
- A firewall can tell you traffic reached a destination. What it can’t tell the privacy team is which personal data was sitting in the prompt, or what got created afterwards.
- DLP will flag a sensitive payload, sure. Reconstructing the full path from source data through the model, retrieval, vector store, tool call and output? Usually not its job.
What a privacy programme needs is evidence that connects data to purpose, processing, processor, geography, retention and rights. One-off security alerts can’t do that.
Design principle
Consiva isn’t another blocking layer. It’s the privacy intelligence layer that makes sense of what happened across the controls an enterprise already runs.
2. The AI data path isn’t the old data path
Classic privacy discovery begins with databases, SaaS apps, files and websites. AI adds something messier: a path that can loop. One step’s output turns into the next step’s input. Look back at Figure 1. Almost every box in it can hold a copy of personal data, and most of those boxes never made it into a data inventory.
So the inventory has to change shape: from “systems of record” to “systems of processing.” Consiva’s Provable Enterprise framework already treats vector stores, training datasets, fine-tuning corpora, prompt logs and agent memory as places AI data lives.
3. Finding PII is only step one
Detecting PII matters. It doesn’t go far enough, though. A privacy team needs to see how the data travels and where it ends up.
| Question | Basic discovery | AI Privacy Intelligence |
|---|---|---|
| What data exists? | Find sensitive fields or files. | Find sensitive data in prompts, responses, RAG content, vectors, memory, logs and derived artefacts. |
| Where is it? | Database, file or SaaS location. | Source → prompt → model → retrieval → vector → tool → output → persistence. |
| Where does it go? | Known application destination. | Observed provider, region, processor and downstream tool path. |
| Can we act on it? | Delete or modify the source record. | Trace and route rights, deletion and investigation across AI-derived locations. |
| Can we prove it? | A scan report. | An evidence chain linking obligation, control, signal, artefact and owner. |
4. A new unit of telemetry: the AI Processing Event
To work at scale, Consiva uses an event model that isn’t tied to any one vendor. The rule of thumb: any meaningful AI interaction can be written down as an “AI Processing Event.”
Figure 2. Anatomy of an AI Processing Event: who, what, where, why and what proof.
Put every AI interaction into one event model and Consiva can look at OpenAI-style APIs, internal models, RAG applications, agent frameworks and enterprise telemetry together, with no single vendor at the centre of the product.
How you collect those events is a separate question. No single collection model will suit everybody. Some customers will give deep access. Others can’t, and shouldn’t have to.
- Runtime. Build your AI app with the Consiva SDK or API and capture events as it runs: the prompts going out, what’s retrieved, which model answers, what comes back.
- Post-processing. Your security and privacy teams feed in logs, SIEM reports, gateway events and app records, and the historical analysis happens later.
- Hybrid. Runtime signals for the AI that matters most, post-processing for the rest of the estate.
- Metadata-only or redacted evidence. In high-security environments, keep classifications, fingerprints, identities and lineage without putting the actual prompt content in one central spot.
5. Built for volume, variety and velocity
Spotting PII isn’t the hard engineering part. The hard part is doing it across enormous event volumes without every event becoming expensive.
- Detect cheaply first. Deterministic patterns and fast classifiers catch the obvious entities.
- Save the expensive AI reasoning for events that earn it: high-risk, ambiguous or policy-sensitive ones.
- Correlate asynchronously. Entity and lineage links get built off the hot request path.
- Track visibility confidence, so what you saw in full never gets mixed up with what was metadata-only or inferred.
6. The AI Privacy Graph, and why one risk score isn’t enough
Single events only tell you so much. Join them up and they start to explain things. The AI Privacy Graph links people, data, applications, prompts, models, agents, documents, vectors, memories, processors, regions, purposes and evidence. It isn’t the data warehouse. It’s the relationship layer that turns single events into a privacy journey someone can explain.
Same idea for risk. A single score is handy for prioritising. Fine. Just don’t let it hide why something is risky. Sensitivity, exposure, propagation, persistence, access, geography, purpose confidence, lineage confidence and rights recoverability all pull in different directions, and an everyday event looks very different from a dangerous one once you plot them.
Figure 3. Risk needs more than one number. An illustrative profile for two AI events.
7. Shadow AI and borders: observe first, interpret later
Building a universal blacklist of AI tools is the wrong goal. Making AI usage observable and risk-ranked is the better one.
- Approved AI handling high-risk data can still be a governance issue.
- Unknown AI touching low-risk data? That might need a conversation, not an escalation.
- Unknown AI receiving customer or employee data jumps the queue.
- A proxy or an alternate route doesn’t settle anything by itself. It’s a signal. Read it alongside the user, the data and the destination.
Borders work the same way. AI can bring geography into a processing path in ways an application inventory won’t show you, so Consiva records it as something observed: where the request started, where the model processed it, where anything was stored or sent on.
The platform reports what it sees, then maps that to the governance rules the customer has set up. Legal assessment stays a separate layer. That one belongs to the customer’s own authorised legal or privacy function.
Figure 4. Telemetry never jumps straight to a legal conclusion.
8. AI-aware DSR and breach investigation
One of the strongest use cases is the data subject request (DSR): finding a Data Principal, the individual whose data it is, across the entire AI processing estate.
- Confirm who the person is, using verified identifiers.
- Search the systems already connected to Consiva, then AI prompts and conversation records.
- Track down the RAG source documents and any related embeddings, where traceability exists.
- Look at memory, application logs and AI-generated artefacts that contain or derive from the person’s information.
- Route what you find to the right owner, then record what turned up, what was done, and what’s still out of sight.
This takes Consiva’s existing privacy-operations model into the AI estate. It isn’t a separate AI security product bolted on the side.
Consiva treats AI-related incidents as a first-class investigation type inside the privacy operations platform, not an afterthought. The patterns repeat: personal data sent to an unapproved AI tool, an agent exporting a payload, a RAG system retrieving a document it shouldn’t, an AI answer shown to the wrong user. Each needs the same reconstruction, and the clock doesn’t wait for the AI team: CERT-In’s 6-hour window applies today [1], and the DPDP breach timeline joins it from 13 May 2027 [2].
Figure 5. From alert to evidence: what an AI breach investigation has to reconstruct.
9. What customers actually need to see
Customers aren’t after a technical event stream. They want answers. Which AI systems are running here, and which are approved, unknown or shadow? What personal data is going in, and where does it end up? Does the path cross a border? What can I show an auditor, a customer or a regulator?
Figure 6. A conceptual Consiva AI Privacy Intelligence dashboard. Illustrative UI, not a production screenshot.
10. Where the market is crowded, and where Consiva fits
The market is clustering around a few strong capabilities: prompt and response protection, AI governance registries, shadow-AI visibility, RAG and vector security, runtime guardrails and AI data access control. Capable tools already cover most of these, one by one, and Consiva isn’t trying to out-build them.
Detecting PII in prompts is table stakes now, not a category on its own. Where Consiva differs is in connecting AI telemetry to privacy operations and evidence, so one person-and-data lineage serves discovery, risk, DSR, breach investigation, processor governance, cross-border analysis and audit evidence. That connection is what Consiva AI Privacy Intelligence is built around.
- Consiva builds: the AI Processing Event model, AI data discovery and lineage, the privacy graph and risk engine, AI-aware DSR, breach forensics and the evidence trail.
- Consiva integrates with: your firewall or SWG, DLP, SIEM, CASB, AI gateway, identity systems and vector databases.
- Consiva doesn’t replace them: not a firewall, a DLP, a SIEM, a gateway or an LLM platform.
Figure 7. Consiva AI Privacy Intelligence at a glance, from AI telemetry to evidence and action.
11. Where privacy operations goes from here
AI doesn’t remove the need for privacy operations. It widens the surface they have to cover. The loop is the one Consiva already runs, SEE to WATCH. What changes is the territory.
Figure 8. The same six-step loop, stretched across the AI estate.
Conclusion: the next privacy control point is the AI data journey
Enterprises will keep adopting AI. Some will block tools. Some will build internal copilots. Others will deploy agents, RAG systems and AI-enabled business apps. In every case, personal and business data will be moving through those systems at machine speed.
So the privacy architecture that wins won’t be the one that just says “allow” or “block.” It’ll be the one that can answer, with evidence:
Can you explain the journey?
What data went into the AI system? Where did it go? What did it create? Where did it persist? Who or what touched it? What risk came of that? What did the organisation do about it? And can it prove any of this later?
That’s what Consiva AI Privacy Intelligence is for. Not another AI firewall. Not another generic PII scanner. A privacy intelligence layer that makes the AI data journey visible, explainable, actionable and provable.
Five things to check this week
Most teams can’t answer those questions on a Monday morning. Try this instead. It takes an afternoon.
- List every AI tool your people use, approved or not.
- Pick one app and trace a single prompt from keystroke to log.
- Find out where its embeddings and memory live, and who can read them.
- Check whether any of it leaves the country.
- Ask whether you could find one customer’s data across all of it, if they asked tomorrow.
If the honest answer to any of those is “not sure,” that’s the gap. We’d be glad to look at it with you.
Frequently Asked Questions
It’s the ability to find, classify, trace, risk-score and evidence personal or sensitive data as it moves through AI applications, prompts, RAG systems, vector stores, agents, memory, tools and AI providers. The aim is to answer, with proof, what personal data your AI estate handles and where it ends up.
Because a prompt rarely stays a prompt. A customer’s name or address in it can be processed by the model, logged, stored, retrieved later and passed on to other tools or providers. The risk sits in what happens after the data goes in, not only in the moment it was typed.
It’s the record of where personal data came from and where it went: from the source system through the prompt, model, retrieval layer, vector store and tools, to wherever outputs and copies end up stored.
Shadow AI is the use of AI tools or services that the organisation hasn’t approved or doesn’t know about. It becomes a privacy issue when customer or employee data is sent to those tools and nobody can see it.
Sometimes, but blocking alone doesn’t solve the privacy problem. People find other routes, and approved AI tools still handle sensitive data through prompts, retrieval and agents. Enterprises need visibility into what actually happens, with blocking as one control among several.
AI security tools mainly protect the interaction itself. Consiva tracks the journey the data takes, linking AI telemetry to discovery, lineage, DSR, breach investigation, processor governance and evidence. It works alongside existing security and enforcement layers, not instead of them.
Assess Your AI Data Visibility: talk to the Consiva team
Not ready for that yet? Run the free website DPDPA and GDPR check, or start on the free plan: 1,000 cookie consents a month, no credit card.
Sources: [1] CERT-In 6-hour reporting window, as covered on Consiva's breach management page. [2] Is DPDP Enforceable Yet? What the Gazette Actually Says and the DPDP Rules 2025 breakdown.