Use Less Data and Keep It Within Approved Boundaries
Work through the explanation, apply it to the example, and complete the quick check before continuing.
Start with purpose
Before entering information into a tool, state why each data item is needed. Collecting or sharing extra information creates extra exposure without improving the task.
Data minimisation means limiting information to what is relevant and necessary for the defined purpose. The exact legal duties vary, so follow the applicable policy and specialist advice.
Minimise in four ways
- Avoid: do not use data the task does not need.
- Reduce: use only the required fields or passage.
- Replace: use fictional or safely prepared synthetic information for practice.
- Restrict: use an approved system with suitable access, retention, and deletion controls.
Removing a name may not be enough. A rare role, exact location, date, and event can identify a person when combined.
Check the full data journey
Ask:
- Where does the input come from?
- Is its use authorised for this purpose?
- Which service receives it?
- Who can access prompts, files, outputs, and logs?
- Is it retained, reused, transferred, or used for model improvement?
- Can it be corrected or deleted under the approved process?
Do not assume settings from one product or plan apply to another.
Worked reduction
Unsafe request:
Paste the complete employee record into a public chatbot and ask it to improve one training paragraph.
Safer approach:
Use the approved internal tool. Supply only the non-identifying paragraph that needs rewriting. Replace real examples with synthetic ones. Do not include names, contact details, performance notes, health information, or account data.
If the tool is not approved for the remaining information, do not proceed.
Remember
- A useful purpose does not permit unlimited data use.
- Remove unnecessary fields and identifying combinations.
- Check the full journey, including logs and retention.
- Stop when authority or tool approval is unclear.
Next, we will look at untrusted content and systems that can take actions.