Data Privacy and Sovereignty in AI-Driven Systems

<p><b><i><span>Background.</span></i></b><span> Data privacy and sovereignty have become first-order operational constraints on AI deployment as the legal infrastructure surrounding personal data has matured globally. The European Data Protection Board's Opinion 28/2024 of 17 December 2024 set out detailed expectations for applying the General Data Protection Regulation to AI models; the Italian Garante imposed a EUR 15 million fine on OpenAI two days later; and AI-specific data protection enforcement has accelerated through 2025 and 2026. Concurrently, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and the Saudi Personal Data Protection Law (enforced September 2023) have established binding regional frameworks, and data sovereignty mandates have proliferated across jurisdictions, materially shaping where and how AI systems can be trained and deployed.</span></p> <p><b><i><span>Purpose.</span></i></b><span> This paper synthesises the data privacy and sovereignty literature applicable to AI-driven systems, examining training data privacy risks, privacy-preserving AI techniques, cross-border data flows and sovereignty tensions, and privacy impact assessment practice. It provides practitioners with an integrated view of the legal, technical, and operational dimensions of data privacy in AI deployment.</span></p> <p><b><i><span>Approach.</span></i></b><span> The paper adopts a narrative literature review methodology drawing on authoritative primary sources, including the EDPB Opinion 28/2024, Regulation (EU) 2024/1689 (EU AI Act), the UAE Personal Data Protection Law, the Saudi Personal Data Protection Law, foundational research on training data extraction (Carlini et al., 2021), differential privacy (Abadi et al., 2016; Dwork and Roth, 2014), and federated learning (McMahan et al., 2017). Sources were selected for authority, currency, and direct relevance to operational practice in regulated AI deployment.</span></p> <p><b><i><span>Findings.</span></i></b><span> Three findings are advanced. First, the privacy risks specific to AI, including training data memorisation, membership inference, and reconstruction attacks, are not adequately addressed by privacy controls designed for traditional data processing and require AI-specific technical and governance treatment. Second, differential privacy and federated learning, while operationally available, present a privacy-utility trade-off that constrains their adoption in production systems and is not fully resolved by current techniques. Third, data sovereignty mandates are converging on a fragmented but persistent set of cross-jurisdictional constraints that materially shape AI architecture and deployment choices.</span></p> <p><b><i><span>Implications.</span></i></b><span> Practitioners deploying AI in regulated environments require integrated data privacy programmes that address AI-specific risks alongside conventional data protection obligations, evaluate privacy-preserving techniques against operational utility requirements, and treat data sovereignty as an architectural rather than a purely contractual constraint. Privacy impact assessments for AI systems require methodological adaptations beyond the practices established for traditional processing.</span></p>