Allowed information
Define the fields, files and environments a model may receive. Prohibit secrets and sensitive records unless the approved architecture specifically supports them.
Route 03 / follow the information
Give every piece of data an owner and an exit.
Data protection begins with a truthful map of the system: what is collected, why it is needed, where it moves, who can see it, how long it remains and who acts when a person asks a question or something goes wrong.
The data path
Trace it before choosing controls.
Lebanon's Ministry of Economy and Trade identifies Law 81/2018 in its official personal-data service. The Office of the Minister of State for Administrative Reform also publishes the law and digital-transformation materials. A qualified local adviser should interpret obligations for the actual organisation and use case.
- CollectList every form field, uploaded file, device signal, cookie, log and inferred value. State the business reason and remove anything collected “just in case.”
- ExplainDecide what users are told, in which language, at which moment and who approves that explanation. Consent is not a substitute for understanding the full legal basis.
- AccessAssign roles, least-privilege permissions, administrator ownership, authentication, recovery and a process for quickly removing access.
- TransferMap hosting, analytics, email, payment, AI and support vendors by destination and purpose. Cross-border delivery from the United States must be visible in the project review.
- RetainGive each record type a retention owner and deletion method. Include backups, logs, exports, support copies and vendor-held data—not only the primary database.
- RespondName the people who handle access or deletion requests, suspicious activity, a lost credential, an incorrect record and a vendor incident.
AI boundary
Do not let a useful model become an invisible data route.
If AI is part of the project, its data access and output authority belong on the same map as every other vendor and user.
Vendor and retention
Verify the account, product terms, storage, training settings, region and deletion controls actually used by the project.
Review and authority
State where a person must verify the result and which decisions the model is never allowed to make on its own.
Safe fallback
Keep a deterministic or human path when the service is unavailable, uncertain or outside the agreed confidence boundary.
Official checkpoints
Use the authority closest to the question.
These links are starting points for current review, not a legal opinion.
Ministry of Economy and Trade
The Ministry's personal-data service references Law 81/2018 and publishes information connected to submitted personal-data processing records.
Open the official serviceOMSAR laws and decrees
OMSAR maintains an official digital-transformation area linking the Electronic Transactions and Personal Data Law.
Review the official law indexProject counsel
Assign a qualified adviser to interpret the law, sector rules, transfers and contractual duties for the organisation's current facts.
See the engagement boundary