Consent Scrub

Explanation

Consent scrub checks that customer data is used in AI models only in line with the consent each customer actually gave — so a customer who declined to have their data used for model training or a given purpose is reliably excluded. This matters immediately under India's consent-centric regime and RBI Safety/Resilience, NIST MANAGE 3.1 and ISO Clause 6.1.2, since using data without valid consent is both a legal and reputational failure. It is measured by the Consent Enforcement Rate = Count(Properly_Enforced_Consent) / Count(Total_Consent_Decisions) for customer data usage in AI models — the fraction of all consent decisions that were correctly honoured. To implement, integrate a consent-checking gate into the data pipeline (Agentic and RAG flows) that, before any record is used, looks up the customer's current consent state and includes or excludes the record accordingly, with consent withdrawals propagated promptly; log every consent decision, the data touched and the enforcement outcome as auditable evidence. The threshold is 100% alignment with no violations: every consent decision must be correctly enforced. Any violation — data used contrary to consent — is a breach that triggers immediate remediation, purging or quarantine of the wrongly used data, and root-cause review of the consent pipeline.