The General Data Protection Regulation (GDPR) gives individuals the right to request the deletion of their personally identifiable information (PII) by organizations, referred to as the right to be forgotten. Amazon Bedrock, an Artificial Intelligence (AI) service, presents some unique challenges when it comes to complying with these requests due to its use of Retrieval Augmented Generation (RAG) and Foundational Models (FMs).
Amazon Bedrock integrates foundational models from leading AI companies, enabling users to quickly deploy models best suited for their use case via an Application Programming Interface (API). These models are trained on vast amounts of data which allow them to answer a variety of queries. However, if a user wants to use a foundational model to answer questions about their private data stored on Amazon Simple Storage Service (Amazon S3), they need to use the technique known as Retrieval Augmented Generation (RAG).
Knowledge Bases for Amazon Bedrock is a fully managed RAG capability that enables you to customize foundational model responses with company-specific data. It automates the end-to-end RAG workflow, which includes integration of data sources and management of queries without the need for custom code.
GDPR compliance becomes challenging with RAG architectures as many organizations use them to build generative AI applications with proprietary data including PII. This post discusses the challenges related to GDPR compliance and the optimum practices for organizations to address right to be forgotten requests. It covers the setup of GDPR compliant RAG architecture pattern using Knowledge Bases for Amazon Bedrock.
The GDPR applies to all organizations located in the European Union, and those outside the EU that process the personal data of EU individuals. Key terms used in GDPR discussions include data subject (an identifiable person resident in the EU whose personal data is held by an organization), processor (entity that processes the data on behalf of the controller), controller (entity determining the purposes and means of processing personal data), and personal data (information relating to an identified or identifiable person).
The post also provides the prerequisites to create a knowledge base and steps for implementing architecture using Knowledge Bases for Amazon Bedrock. It further discusses deleting customer information from the knowledge base as per the right to be forgotten, while also touching upon supporting considerations like audit tracking, data discovery and findability, backup and restore, communication, and security controls.
In conclusion, it highlights the significance of GDPR compliance, stating that it strengthens trust and safeguards personal data. It also emphasizes that the information provided in the post does not constitute legal advice and organizations must consult with their privacy officers or legal counsel for specific solutions.
