OWASP GenAI Security Project publishes 'GenAI Data Security Best Practices v2 — Part 1'

On 3 November 2026 the OWASP GenAI Security Project released 'GenAI Data Security Best Practices v2 – Part 1' (listed on genai.owasp.org resources dated 3 Nov 2026; announced by the project's own channels on 3 Nov 2026). It is the root/first part of a twelve-part implementation playbook that serves as a companion to the project's 'Risks and Mitigations 2026' (GenAI Data Security) document. Part 1 establishes scope and conventions, GenAI data-security fundamentals and six core principles, then details how to build an AI-DSPM (data security posture management) program: operating models, build-versus-buy guidance, 90/180/365-day rollout sequencing, operational KPIs, integration with security operations, and common anti-patterns.

This is a substantive, in-window OWASP guidance publication that moves the GenAI Security Project's data-security work from a risks-and-mitigations catalogue into an implementable, sequenced program for enterprises. It addresses a concrete gap — securing the data layer of GenAI/agentic systems (sensitive-data exposure, model memory, unsanctioned data flows) rather than only application-layer prompt risks — and gives data-security/GRC teams an actionable roadmap (operating model, KPIs, rollout sequencing, SecOps integration). As the first part of a 12-part series it sets the frame for the rest of the playbook.

For enterprise data-security and AI-governance teams: read Part 1 to adopt the six core principles and the AI-DSPM operating model; use the build-versus-buy guidance and 90/180/365-day sequencing to scope an AI data-security program and the KPI/anti-pattern guidance to structure rollout. Track subsequent parts of the twelve-part playbook.