Rights & Ethics

data protection

Legal and technical measures to secure personal and sensitive data.

How the laws define this

Regulatory and technical frameworks consistently define data protection as the implementation of legal, technical, administrative, or physical safeguards designed to secure information against unauthorized access, use, disclosure, modification, or destruction. At its core, every source requires established protocols or measures to preserve data confidentiality and integrity. However, these instruments diverge on the specific scope of data and operational contexts governed. The Lagos State AI Guidelines and the Digital Pakistan Policy (2018) focus primarily on safeguarding personal or sensitive data to uphold individual privacy and data subject rights. In contrast, IEEE 7002-2022 — Standard for Data Privacy Process takes a broader operational approach, explicitly guarding both static and dynamic data. Distinct from these, the Resolución 4/2025 de la Subsecretaría de Gobierno Digital del Ministerio de Gobierno - Directrices de uso de Inteligencia Artificial Generativa en la Administración Pública de la Provincia de Buenos Aires applies specifically to sensitive public and personal information processed or generated by artificial intelligence systems within the public administration, adding the protection of availability alongside confidentiality and integrity.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Argentina	Resolution 4/2025 - Guidelines for the Use of Generative Artificial Intelligence in the Public Administration of the Province of Buenos Aires	In Force	Limits data protection to AI systems in Buenos Aires public administration, emphasizing strict adherence to protocols for confidentiality, integrity, and availability of sensitive information.
IEEE	IEEE 7002-2022 — Standard for Data Privacy Process	In Force	Broadens to administrative, technical, or physical means protecting both static and dynamic data against unauthorized use, disclosure, modification, or destruction.
Nigeria	Lagos State AI Guidelines	Adopted	Explicitly includes ensuring privacy and data subject rights alongside safeguarding personal data from unauthorized access, use, disclosure, alteration, or destruction.
Pakistan	Digital Pakistan Policy (2018)	Adopted	Envisages a dedicated data protection law and regulatory frameworks covering rules for collection, processing, storage, sharing, and access to personal and sensitive data.

What it triggers

In the public administration of Buenos Aires Province, it mandates human oversight, prior authorization, data anonymization, and clear labeling of AI-generated content.source
IEEE 7002-2022 sets out a standard for integrating data privacy processes into the systems engineering lifecycle using PIAs for compliance.
The Lagos State AI Guidelines guide AI developers and companies on ethical and transparent system design.source
The Digital Pakistan Policy directs government agencies to accelerate digital transformation, ICT infrastructure expansion, and emerging technology adoption including AI.source

Definitions (4)

Legal and technical measures intended to secure personal and sensitive data, covering rules and safeguards for collection, processing, storage, sharing and access, and envisaging a dedicated data protection law and related regulatory frameworks.

Digital Pakistan Policy (2018)Definition 1 of 4

The legal and technical measures taken to safeguard personal data from unauthorized access, use, disclosure, alteration, or destruction, ensuring privacy and data subject rights. It involves securing information and respecting individual control over personal data.

Lagos State AI GuidelinesDefinition 2 of 4

Refers to the strict adherence to established protocols and legal frameworks designed to protect the confidentiality, integrity, and availability of sensitive public and personal information processed or generated by AI systems within the public administration.

Resolución 4/2025 de la Subsecretaría de Gobierno Digital del Ministerio de Gobierno - Directrices de uso de Inteligencia Artificial Generativa en la Administración Pública de la Provincia de Buenos AiresDefinition 3 of 4

Data protection refers to the implementation of appropriate administrative, technical, or physical means to guard against unauthorized use, intentional or accidental disclosure, modification, or destruction of data. This encompasses both static and dynamic data, ensuring its integrity and confidentiality.

IEEE 7002-2022 — Standard for Data Privacy ProcessDefinition 4 of 4

Not to be confused with

data security

Data security focuses on protecting and lawfully using data through necessary measures, while data protection encompasses broader legal and technical safeguards including privacy rights.

Privacy-by-design

Privacy-by-design is a specific approach incorporating data protection into systems' design and architecture, whereas data protection covers general measures across the data lifecycle.

Data Protection Authority (DPA)

A Data Protection Authority is the supervisory body overseeing data protection, while data protection refers to the measures themselves implemented under such oversight.

Questions and answers

What does data protection require in Buenos Aires public administration AI use?

It requires strict adherence to protocols protecting confidentiality, integrity, and availability of sensitive information, with human oversight, prior authorization, data anonymization, and labeling of AI content.

How does IEEE define data protection measures?

It includes administrative, technical, or physical means to guard against unauthorized use, disclosure, modification, or destruction of both static and dynamic data.

What safeguards does the Lagos State AI Guidelines definition include?

It covers legal and technical measures to safeguard personal data from unauthorized access, use, disclosure, alteration, or destruction, ensuring privacy and data subject rights.