Pathway: AI for data protection and privacy officers Module 5 of 5
Citizens, rights and trust
What citizens can reasonably expect when AI is used with their information, and how to explain it to them in plain language.
Last reviewed: . Reviewer: Muhammad Asadullah.
Why this matters
Citizens do not choose to give the state their information. They give it because the law or a service requires it. That creates a duty to handle it with care, and to be open about how. Trust built this way is valuable, and public use of AI can strengthen it or damage it.
What citizens can reasonably expect
Whatever the exact legal rights turn out to be, good practice points to six expectations:
- To know. To be told when AI is used with their information or to help decide something about them. This is transparency.
- To understand. A plain explanation of how a decision was reached, not only a result. This is explainability.
- A person in charge. For matters that affect them, a human who takes the decision and can change it. This is human oversight.
- To be asked, where it applies. Where their consent is the basis for using their data, it should be real, informed and withdrawable.
- To correct. A way to put right an error in their record, especially if it was fed into an AI tool.
- To complain and be heard. A route for redress: someone to complain to, an answer in reasonable time and a fix when the office was wrong.
Do not promise rights the law does not give. The National AI Policy 2025 refers to a draft personal data protection law, so check the current legal position with your legal adviser before you tell citizens what they are entitled to.
Being open in public
The policy calls for disclosure of where AI is used in the public sector, including a public register of public sector AI systems. An algorithmic register is a simple public list of each system: what it is for, what data it uses, who is responsible and how to ask questions. Even before a national register exists, your department can publish its own short list.
Writing a notice citizens will read
A privacy notice that nobody understands is a notice that does not work. Good notices:
- use plain words in Urdu first where most of the public is Urdu-speaking, with English as well
- say in one sentence what is collected and why
- say whether AI is used and for what, with a person reviewing decisions
- say how long the data is kept
- say how to ask a question, correct a record or complain, with a real address, phone number or email
AI can help with the drafting of a notice. A person who knows the law must check it, and an Urdu reader should check the Urdu. See AI and citizen-facing services for more.
Make it an office habit
- Write a short AI use note for each tool: what it is used for and what data it may touch.
- Review the approved list every few months and remove tools nobody needs.
- Train new staff in the first week, using real examples from your own office.
- Keep accountability clear: a named officer is responsible for each use.
Try it
Write a five-line notice for citizens whose complaint replies are drafted with the help of an AI tool: what is collected, why, whether AI is used, how long it is kept and how to ask a question. Read it aloud to someone outside your office and ask what they did not understand.
Check yourself
- Name three things a citizen can reasonably expect when AI is used with their information.
- Why should you check the current legal position before telling citizens their rights?
- What does an algorithmic register show?
Answers: (1) Any three of: to know, to understand, a person in charge, to be asked where it applies, to correct, to complain and be heard. (2) The policy refers to a draft law, and promising rights the law does not give would mislead them. (3) What each AI system is for, what data it uses, who is responsible and how to ask questions.