Chapter C11 · Interactive Course
Protect people and information
Decide what to send, and what to do if too much went out.
Core Learning Concept
Prepare a useful request while minimizing disclosure. Inspect every detail for relevance, sensitivity, and whether the intended service is appropriate. Replace unnecessary identifiers with placeholders, and remember that combinations of ordinary details can still identify someone. All records in this practice are fictional.
What You’ll Learn in This Chapter
-
Recognize sensitive details
Identify information that should not enter an unapproved service.
Sensitive information includes passwords, financial data, and personal records that could harm someone. Most writing tasks need only the sentence structure, not actual private details. Check whether your request truly needs personal data before pasting it.
-
Share the minimum needed
Preserve usefulness while reducing unnecessary disclosure.
Data minimization means sharing only the details strictly needed for the task. When drafting a reminder, replace names and amounts with placeholders like [name] and [amount]. This keeps your prompt useful without disclosing private information.
-
Removing a name is not enough
Recognize that combinations of details can identify someone.
Removing a name does not necessarily make a record anonymous. A rare job, small town, exact date, and unusual event may identify one person together. Review the combination of remaining details, not just individual fields. Remove or generalize information the task does not need.
-
Other people's information needs care
Check permission before providing another person's material.
Being able to read a document does not automatically authorize sending it to another service. Consider who supplied it, who is described in it, and what use was agreed. If the allowed use is unclear, resolve that question or use a fictional example instead of forwarding the real material.
-
Settings answer different questions
Distinguish chat history, saved memory and future training choices.
History, memory, training use, and retention are four separate things. A toggle labelled "history" only controls what you can revisit. It does not automatically wipe stored memory or stop server retention. Always check what each privacy toggle actually covers.
-
Shared links have an audience
Inspect who can open a shared conversation or file.
A shared link changes who may access material. “Anyone with the link” can include people beyond the original recipient if the link is forwarded. Review the audience, permissions, and included content before sharing. A private conversation does not stay private merely because its link is difficult to guess.
-
If something private was shared
Choose a practical containment step after an accidental disclosure.
If private information was shared, first stop further disclosure and identify what was exposed and where. Use the service’s available access controls and the appropriate reporting or support route. Exposed credentials need revocation or replacement. Deleting a visible message alone may not remove every retained or copied version.
-
Clean up a request before sending
Build a minimal brief, spot indirect identifiers, inspect a sharing audience and choose a response to an accidental disclosure.
In-Depth Practice & Real-World Application
Workplace Scenario: Protecting personal, customer, and proprietary company data when working with AI tools.
Worked Example: Entity Sanitization via Bracketed Placeholders
Common mistake: Pasting confidential customer contract terms, actual account balances, and individual executive email addresses into a public AI chat.
Effective pattern: Replacing real identifiers: “Client [AlphaCorp], current tier [Tier 2], annual commitment [$X00,000], requested renewal discount [Y%].”
Sanitizing private data allows you to get high-quality advice on contract wording or negotiation strategy without exposing confidential PII.
Key Takeaways
- Public consumer AI models may retain prompt logs for training and moderation review.
- Never input PII (SSNs, medical data, personal contact info) or credentials (passwords, API tokens).
- Understand your employer’s enterprise data policy before using AI tools on corporate assets.
Workplace tip: Build a personal prompt sanitization checklist: scan for Names, Numbers, Locations, and Secrets before submitting prompts.