Regulatory compliance (GDPR, AI Act) in MLOps - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding GDPR's Data Minimization Principle

Which of the following best describes the data minimization principle under GDPR when designing an MLOps pipeline?

A Collect and store only the data necessary for the specific ML task and no more.

B Collect as much data as possible to improve model accuracy, regardless of relevance.

C Store all raw data indefinitely to allow future model retraining without restrictions.

D Share collected data freely with third parties to enhance collaboration.

💡 Hint

Think about limiting data to what is strictly needed.

GDPR requires that only data necessary for the intended purpose is collected and processed, reducing privacy risks.

💻 Command Output

intermediate

Output of Data Access Log Query for GDPR Audit

You run this command to query user data access logs in your MLOps system for a GDPR audit:

kubectl logs mlops-data-access-pod | grep 'user123'

What output would you expect if user123 accessed data on 2024-06-01 at 10:00?

MLOps

kubectl logs mlops-data-access-pod | grep 'user123'

A Error: pod mlops-data-access-pod not found

B 2024-06-01T10:00:00Z user123 accessed dataset customer_data.csv

C No entries found for user123

D 2024-06-01T10:00:00Z user456 accessed dataset customer_data.csv

💡 Hint

Look for the exact user ID and timestamp in the logs.

The command filters logs for 'user123', so the output shows their access record with timestamp and dataset.

🔀 Workflow

advanced

Correct Workflow to Ensure AI Act Compliance in Model Deployment

Which workflow sequence correctly ensures compliance with the AI Act when deploying a high-risk AI model?

A 2,1,3,4

B 1,3,2,4

C 3,1,2,4

D 1,2,3,4

💡 Hint

Think about the logical order from assessment to deployment.

First assess risks, then implement transparency, get certifications, and finally deploy with monitoring.

❓ Troubleshoot

advanced

Troubleshooting Data Subject Access Request (DSAR) Automation Failure

Your automated DSAR system in the MLOps pipeline fails to retrieve all user data. Which cause is most likely?

A The data indexing service is not updated with recent user data changes.

B The Kubernetes cluster is running out of CPU resources.

C The ML model accuracy is below 90%.

D The AI Act requires manual DSAR processing only.

💡 Hint

Consider what affects data retrieval completeness.

If the indexing service is outdated, the DSAR system cannot find all user data, causing incomplete responses.

✅ Best Practice

expert

Best Practice for Logging to Meet GDPR and AI Act Requirements

Which logging practice best meets both GDPR and AI Act compliance in an MLOps environment?

A Log full user data in plaintext for easy debugging and audit.

B Log only errors without user context to reduce storage costs.

C Log all user interactions with anonymized identifiers and secure logs with restricted access.

D Disable logging to avoid storing any personal data.

💡 Hint

Think about privacy and auditability together.

Logging anonymized user interactions with secure access balances privacy and traceability required by GDPR and AI Act.