Thaki Cloud Presents Four Data-Control Questions for AI Use

Thaki Cloud has presented four data-control questions that individuals and enterprises should consider when using AI, pointing to a growing concern that the question “Where does the information I enter into AI go?” is evolving into an issue of data sovereignty and operational responsibility in enterprise AI environments.

As generative AI expands from search, writing, summarization and translation into workflow automation and AI agents, users are entering more information directly into AI services. This has increased attention on whether that information is stored, used for AI training, shared with external services, and whether it can be deleted after use.

According to a 2025 survey by the Korea Press Foundation’s Media Research Center of 1000 adults aged 20 to 60 who were familiar with generative AI, 88.7% of respondents said they were concerned that AI could infringe their rights relating to personal information.

Korea’s Personal Information Protection Commission (PIPC) also published its Personal Information Protection Guide for Users of Generative AI Services in May, advising users to understand how their information is handled before and after using AI services. Key recommendations include checking whether submitted information may be used for AI training and whether that use can be restricted, reviewing conversation-history retention and deletion policies, checking whether personal or third-party information is included, using organization-approved AI services for work materials, and granting only the permissions necessary when connecting external services.

Earlier, in April, the PIPC revised its Guidelines for Preparing Privacy Policies. The guidance recommends that generative AI services disclose when user inputs, including text, voice and uploaded files, as well as generated outputs, are collected or stored. It also recommends that privacy policies explain whether submitted information may be used for AI model training and describe available opt-out procedures.

From a Personal Privacy Question to an Enterprise Operating Standard

Thaki Cloud explained that personal-information protection and data sovereignty are not the same concept, but that the two increasingly intersect around the question of control: how information is used and how much authority the individual or organization retains over that use.

For an individual user, the issue may involve a single prompt or uploaded file. In an enterprise, however, it can extend to customer information, internal documents, contracts, research materials, source code, and other business data, as well as the permissions granted to employees, AI systems, and external services that use that data.

Thaki Cloud proposed four questions that both individuals and enterprises should consider when using AI.

1. What information is being submitted?
Individuals need to consider not only their own personal information but also information belonging to others. At the enterprise level, Thaki Cloud said organizations need policies defining which categories of business data may be submitted to which AI services.

2. How is the information used, and how long does it remain?
In addition to model-training policies and conversation histories, enterprises may need to manage the retention of agent memory, operational logs and other information generated during AI workflows, the company said.

3. What is the AI connected to?
As AI systems connect to external services, APIs and tools, organizations can no longer assume that data remains within a single application. Thaki Cloud said enterprises should therefore manage which systems, tools and permissions are available to AI and AI agents.

4. Can the use of that information be stopped, deleted or changed?
For individual users, this may involve training opt-outs and conversation deletion. For enterprises, Thaki Cloud said the issue can extend to revoking permissions, changing services, and defining retention and deletion policies for data, logs and memory.

AI Agents Are Changing What It Means to “Entrust Data to AI

These issues become more complex as AI agents take on greater autonomy inside enterprise environments.

In September, Korea’s Personal Information Protection Commission disclosed findings from interviews with 15 domestic and international organizations developing or adopting AI. Participants identified prompt injection and excessive agent permissions as key risks, while also highlighting the need for clearer boundaries between autonomous actions and human approval, defined responsibilities among participants, and policies governing the retention and deletion of personal information contained in logs and memory.

Thaki Cloud said the shift from generative AI to agentic AI expands data control beyond the question of what information a user enters. When an AI agent can access enterprise data, invoke APIs and tools, and take actions inside business systems, organizations also need to determine what the AI is authorized to do.

The company said employee guidance alone — for example, telling workers not to enter sensitive information into AI — is unlikely to be sufficient as an enterprise control model.

Organizations also need to decide which AI services are approved for business use, which data categories may be submitted, which systems and APIs an AI agent may access, which actions require human approval, and how long logs and memory should be retained before deletion, according to Thaki Cloud.

Thaki Cloud emphasized that this does not mean enterprises should reject external AI services or public cloud environments. Rather, it said organizations should distinguish between workloads that can appropriately be delegated to external services and those that require greater direct control, while retaining the ability to make that decision themselves.

Just as individual users increasingly need to understand AI training, retention and connected-service permissions when choosing an AI service, Thaki Cloud said enterprises should evaluate not only performance and convenience but also where and how data is processed, which controls are delegated to external systems, and whether those decisions can later be changed or reversed.

▶ Find Out More: Data Sovereignty in 8 Slides
Contact Us: https://thakicloud.com/contact