What data should you keep out of AI?
Minimum necessary data, controlled access, and a clear data flow. A practical starting point before integrating AI.
AT A GLANCE
Do not automatically send passwords, access keys, or personal and confidential information unnecessary for the task. Before connecting an AI service, map the data flow, providers, and review points. Define allowed inputs and prohibited downstream actions in advance.
- Send the necessary excerpt instead of the whole document.
- Check terms for the specific provider product.
- Model output must not grant access permissions.
Start with the task, not the available data
If the task is to identify an email topic, it may not need the signature’s phone number, the full conversation history, or an attached contract. Describe the precise task first and then map the fields necessary to complete it.
“Maybe useful later” is a poor transfer rule. Minimal inputs are easier to inspect and test. For personal information, the EU General Data Protection Regulation includes purpose limitation and data minimisation among its principles. Work out how those requirements apply to the actual data and workflow rather than treating them as a box to tick.
Separate secrets from business content
Passwords, API keys, and access tokens should not appear in text sent to a model. They are application secrets and should be handled by the application. Review customer details and commercial agreements separately according to the task and permitted access.
Replace sensitive examples with synthetic or appropriately anonymised data where possible. Removing a name does not necessarily make a case anonymous: distinctive circumstances, identifiers, or related text can still identify someone. Check the complete example rather than assuming a simple replacement has removed every identifying detail.
Understand the entire data path
Information can appear in more places than the model provider. It may pass through an integration service, a work queue, and logging systems. Map those points and check where storage occurs, who has access, how long data remains, and how deletion works.
Review provider terms for the exact product and configuration. A consumer chat interface and a business API can handle data differently. Do not infer training, retention, or processing terms from a brand name. Involve appropriate expertise when making decisions about personal data. The written design should describe the actual configuration you intend to operate.
Incoming text is not an application instruction
A document can contain text trying to make an AI ignore its original task. External content should therefore not be treated as a trusted instruction to the application. Check model output before it triggers actions in another system.
Use a narrow output format and an approved set of values. The application must enforce access rights through its own rules. Significant actions should have human approval, and the model should receive no broader tool access than the task requires. A model’s confident explanation cannot replace an authorisation check.
A starting checklist for a small pilot
Document permitted input fields, excluded data types, the provider, storage locations, and an accountable owner. Decide which results may proceed automatically, which need human review, and which actions are prohibited under all circumstances. Make those boundaries testable.
Include invalid and incomplete inputs in the pilot. Check that logs do not contain complete emails, secrets, or unnecessary personal information. Data security belongs to the full workflow. A good prompt alone does not replace clear permissions, controlled storage, and human responsibility. Revisit the design when adding a new data source, provider, or downstream action, because each can change the original assumptions.
A PRACTICAL TEMPLATE
AI data-flow and classification checklist
Use the checklist to trace where data comes from, what is transferred, where it is stored, who can access it, and which human decision remains in the workflow.
- Source and destination
- Necessity and sensitivity
- Storage and access
- Deletion and human decision
Sources and further reading
- API Security ProjectOWASP · Checked: 2026-09-15
- General Data Protection Regulation, Article 5European Union · Checked: 2026-09-15
Borbély Kristóf
The developer behind Kriside, writing practical guides about web systems, automation, and AI solutions.
