Data Privacy and Sensitive Information

Key jargon

Term	Plain-language meaning
Personally identifiable information (PII)	Information that identifies or can reasonably be linked to a person.
Data minimization	Collecting, processing, and retaining only what is necessary.
Redaction	Removing or masking sensitive values before wider use.
Retention policy	Rules defining how long data is kept and how it is deleted.

Key concepts

Map sensitive data across prompts, logs, caches, vector stores, model providers, tools, and human review.
Redaction is one control; minimize access and retention because indirect clues can enable re-identification.

Concept map

flowchart LR
    A["Classify data and purpose"] --> B["Minimize and redact"]
    B --> C["Enforce access and retention"]
    C --> D["Audit use and deletion"]

Data lifecycle

Inventory collection, preprocessing, transmission, provider handling, context, retrieval index, memory, logs, evaluation sets, feedback, fine-tuning, output, sharing, retention, deletion, and backup.

Controls

Purpose limitation and data minimization.
User/tenant authorization before retrieval.
Redaction or tokenization before model access.
Contractual retention/training-use controls for providers.
Encryption and access control for stores and traces.
Output filtering based on source permissions—not keyword lists alone.
Proven deletion from primary, derived, and backup stores where required.

Exercise

Create a data-flow table for an HR assistant. Label personal, sensitive, confidential, derived, and public data; record allowed destination, retention, and owner.

Misconception

Embeddings are derived data, not automatically anonymous data. They can retain relationships and remain subject to access and deletion requirements.