AI-generated inferences to drive most privacy incidents by 2029: Report

New Delhi: Most privacy incidents will arise from AI‑generated inferences about individuals by 2029, rather than from direct exposure of personally identifiable information (PII), a report said on Friday.

The report from Gartner, Inc said advances in generative AI and machine learning enable attackers to extract sensitive attributes such as health conditions or behavioural patterns from seemingly innocuous, anonymised or aggregated data.

As organisations reduce the amount of personal data they store due to regulatory and cost pressures, threat actors’ access to AI now lets them perform inference-based attacks.

“There is a fundamental shift underway from data exposure to insight exposure,” said Bart Willemsen, VP Analyst at Gartner.

“Organisations have historically focused on protecting raw personal data, but AI can now reconstruct deeply personal insights without ever breaching traditional data controls. Privacy risks are increasingly emerging from what AI algorithms infer about individuals rather than what data is directly exposed,” he added.

Inference attacks are particularly dangerous because they often evade conventional detection mechanisms, Willemsen said. “Individuals can be exposed through AI-generated conclusions rather than leaked records, creating privacy risks that undermine data integrity and are difficult to detect, explain and mitigate,” he added.

The report predicted that spending on data integrity protections will reach parity with data confidentiality investments by 2028 as organisations respond to risks from inaccurate, biased or unauthorised AI‑generated profiles.

Organisations that continue to treat privacy solely as a data protection challenge will be increasingly vulnerable to privacy incidents driven by AI-generated inferences.

The firm urged security leaders to embed AI governance into privacy programmes, adopt privacy‑enhancing technologies such as differential privacy and synthetic data, along with strengthening data minimisation and lifecycle controls.

"Limit data collection to essential business needs and ensure strict access control and timely deletion of data to reduce the information available for inference-based attacks," it noted.

ABOUT THE AUTHOR

The Hans India