{"id":"GRD-005","section":"Runtime Guardrails","requirement":"Detect general, customer, employee and bulk PII","acceptance":"Correctly classify realistic personal, customer, employee and multi-person records inside contextual prompts.","tier":"AT0–AT4","whyItMatters":"Personal data is the most regulated thing employees paste into AI, often as whole records rather than single fields.","verificationMethod":"LT","verificationTest":"Realistic customer, employee and multi-person records in pilot prompts are detected on default configuration.","formerly":"DAT-009","alsoIn":[],"sort":15,"adoptionContext":"Personal data can be submitted through any listed employee AI context; the tier does not determine whether the content is sensitive.","mappings":[{"frameworks":["csf"],"explanation":"Contextual recognition of individual and bulk personal records supplies a detection input for protecting data in transit. Classification alone does not prevent release.","kind":"framework","references":{"csf":["PR.DS-02"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"Personal-data findings make relevant privacy exposure visible for examination and documentation. Recognizing PII does not complete the AI system’s privacy-risk assessment.","kind":"framework","references":{"rmf":["MEASURE 2.10"]},"relation":null,"conditions":[]},{"frameworks":["soc2"],"explanation":"PII recognition informs transfer controls and, for records designated confidential, confidential-information identification. It does not establish notice, consent or a complete privacy program. C1.1 applies only when the Confidentiality category and relevant information are in scope.","kind":"framework","references":{"soc2":["CC6.7","C1.1"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Contextual PII recognition feeds leakage controls and privacy safeguards. A.8.12 needs an operated leakage-protection workflow with approved handling rules and defined alert triage, warnings, blocking or another protective response. Detection does not determine a lawful basis, fulfill privacy rights or establish regulatory compliance.","kind":"framework","references":{"iso27001":["A.8.12","A.5.34"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-005","frameworkRefs":{"ISO27001":["A.8.12","A.5.34"],"NIST-CSF":["PR.DS-02"],"NIST-AI-RMF":["MEASURE 2.10"],"SOC2":["CC6.7","C1.1"]}}