AI-generated inferences to become major data protection threat by 2029

New research by Gartner predicts that by 2029, most data protection incidents will stem from AI-generated inferences rather than direct exposure of personal data. As organisations reduce the amount of personal data they hold due to regulatory and financial pressures, threat actors are increasingly using generative AI and machine learning (ML) to extract sensitive attributes, such as health conditions or behavioural patterns, from aggregated or anonymised data.

Gartner Analyst Bart Willemsen highlighted a fundamental shift from data exposure to insight exposure. Conventional controls often fail to detect inference-based attacks because risks emerge from algorithmic conclusions rather than stolen records. As a consequence, Gartner forecasts spending on data integrity protections will equal data confidentiality investments by 2028 as businesses combat inaccurate, biased, or unauthorised AI-generated profiles.

To mitigate inference risks, Gartner recommends embedding AI governance into data protection operations, implementing privacy-by-design principles into AI development, and deploying privacy-enhancing technologies (PETs) such as differential privacy and synthetic data. Organisations should also strengthen data minimisation, enhance cyber threat monitoring for indirect exploitation patterns, and maintain human oversight to validate sensitive AI-generated inferences before taking operational action.

Training Announcement: The BCS Foundation Certificate in AI examines the challenges and risks associated with AI projects, such as those related to privacy, transparency and potential biases in algorithms that could lead to unintended consequences. Explore the role of data, effective risk management strategies, compliance requirements, and ongoing governance of the AI lifecycle and become a certified AI Governance professional. Find out more.