At Standard Chartered, privacy questions arrive before model training. Can the data be used, where may it be processed, and who remains accountable when the system enters production? For a bank operating across many jurisdictions, the answers shape architecture rather than merely approving it.
David Hardoon, global head of AI enablement, says privacy functions have become the starting point for most AI regulation. They influence datasets, transparency, deployment location, monitoring, and the degree of human oversight.
Privacy becomes a design input that determines what kind of AI can exist in each market.
Production Expands the Data and Control Surface
A pilot may use a limited, understood dataset. A live system draws from multiple upstream platforms with different schemas, quality, owners, and retention rules. Scale increases both the usefulness of the model and the consequence of a control failure.
Some customer information cannot be used for training, requiring anonymised data or other approaches that may affect speed and performance. Fairness, ethics, accountability, and transparency must continue as the processing scope expands.
Data lineage is therefore essential. Teams need to know where each input originated, which transformations were applied, whether consent and purpose still cover the use, and how an individual can exercise applicable rights.
Testing should include privacy failure modes: excessive retrieval, memorisation, inappropriate inference, data in logs, and outputs that reveal information to the wrong user. Accuracy alone does not make a banking system safe.
Privacy reviews should repeat when a model, dataset, purpose, or jurisdiction changes; the original approval cannot silently follow a different system.
Sovereignty Produces a Layered Architecture
Data-localisation rules and cross-border restrictions vary by market. Some workloads may use shared foundations when contractual and technical controls permit transfers; others must operate locally because sensitive information cannot leave the jurisdiction.
Standard Chartered consequently uses a mixture of global and market-specific deployment. Hardoon notes that privacy law often does not prohibit transfers outright but requires appropriate safeguards. The details decide where centralisation remains practical.
Sovereignty involves more than server location. The bank must consider administrators, encryption keys, support access, backups, model providers, and laws that may apply beyond the place where data was collected.
A layered architecture can preserve reusable identity, monitoring, evaluation, and development patterns while keeping protected data and inference within local boundaries. It avoids choosing between total duplication and one global platform that cannot satisfy every regulator.
Standardisation Makes Privacy Easier to Apply
Standard Chartered is creating pre-approved templates, architectures, and data classifications. Codifying residency, retention, and access requirements lets delivery teams reuse controls instead of interpreting the same rule for every project.
This can accelerate responsible deployment. A known low-risk pattern should not require the same review as a novel system affecting customer outcomes. Standard components make deviations visible and allow privacy specialists to focus on the difficult cases.
People remain central. Employees must understand what data they may use, how it should be handled, and when to escalate. External vendors do not absorb the bank’s accountability, and automation does not remove the need for explainability or consent.
Human oversight should be proportionate to impact. Customer-facing decisions and regulatory obligations require clear ownership and routes for review. Monitoring must continue after launch as inputs, models, laws, and user behaviour change.
The bank’s approach reframes compliance. Privacy is often described as friction imposed on an otherwise complete product. Here it helps define the product’s data, geography, controls, and limits from the beginning.
That discipline may produce different versions of AI across markets, but it also creates a service the institution can defend. In regulated finance, the ability to explain why a system runs where it does—and why certain data never reaches it—is part of the architecture’s value.
