## Key points from the source The OECD explains that AI training data may include user prompts and publicly available web data, creating a need to enable data access while protecting privacy. Generative AI services should explain how personal data is processed and whether it is used for training or refinement, moving beyond static privacy policies toward just-in-time transparency and more granular user controls. Correcting or deleting personal data memorized in model weights is technically difficult, while transfers among AI agents make consent and control more complex. The brief identifies data lineage, filtering, safety evaluation, and controls on web scraping as practical governance measures. ## TABS Company's business perspective Before adopting an AI service, organizations should determine whether prompts and attachments are retained or used for training, whether users can opt out, and whether deletion requests propagate across models, retrieval stores, and connected tools. For agentic workflows, organizations should document the purpose and retention period of each data transfer and treat data lineage and access control for personal-data inputs as operating requirements. Source: OECD, “Enhancing user control and privacy protections in the context of AI,” OECD Policy Briefs No. 68, 15 October 2026, DOI: 10.1787/e0bd9a46-en. This is an unofficial English translation of TABS Company's Korean summary and adaptation of an OECD work. The opinions and arguments expressed do not necessarily reflect the official views of the OECD or its member countries. In the event of any discrepancy, the original OECD work prevails.