Retention and deletion, how long data is kept and everywhere it must be removable from.

Model interpretability, so individual outputs can be explained to customers who query them.

Encryption standards for data at rest and in transit across all system components.

Vendor certifications, confirming the platform already meets the retailer's own obligations.

Data residency, which jurisdictions the data and its processing may occur in.