# pc-no-personal-data-external.policy-card.yaml: Policy Card pc-no-personal-data-external version 1.0.0.
# Validates against https://aigovernanceengineer.com/schemas/policy-card.v1.json
# Generated by the Policy Card builder, https://aigovernanceengineer.com/toolkit/policy-card
# Illustrative, review before use. Indicative, not legal advice and not a conformity claim.
"$schema": "https://aigovernanceengineer.com/schemas/policy-card.v1.json"
card_id: pc-no-personal-data-external
version: "1.0.0"
title: "No personal data to external models"
owner: ai-governance-engineering
applies_to:
  - "model-gateway:*"
source_policy: "ai-policy.yaml#rules/sanctioned-genai-tools"
rules:
  - rule_id: data.no-personal-data-external.v1
    description: "No request that carries personal, special_category data is sent to a model hosted outside the organisation; a request without a data classification is treated as carrying it."
    effect: deny
    condition: "the model is not hosted internally and the request carries one of personal, special_category, or carries no data classification"
    failure_mode: "Personal data leaves the organisation in a prompt to a third-party model."
    enforcement_points:
      - runtime
    implementation:
      engine: opa_rego
      module: policies/pc-no-personal-data-external.rego
      entrypoint: data.aige.cards.pc_no_personal_data_external.verdict
    maps_to:
      - AIGE-OBL-ISO42001-A7
      - AIGE-OBL-ISO42001-A10
      - AIGE-OBL-OWASP-LLM
exceptions: "Requested by the system owner, approved by the AI governance committee for at most 90 days, and recorded as a signed verdict override with an expiry."
effective_from: "2026-10-01"
review_by: "2027-04-01"
extensions:
  generated_by: "https://aigovernanceengineer.com/toolkit/policy-card"
  template: no-personal-data-external
  notice: "Illustrative, review before use. Indicative, not legal advice and not a conformity claim."
  cedar_module: policies/pc-no-personal-data-external.cedar
  ci_hook: ".github/workflows/policy-card-pc-no-personal-data-external.yml"
  approval_pending_from: ai-governance-committee