Privacy and Confidential Information Gates

Unit ID: PAW-M11-U03 Estimated active time: 20-25 minutes

A gate, not a guideline

"Be careful with personal data" is advice, and advice is followed inconsistently under time pressure.

A gate is a step in the workflow with a decision attached: this content may go, that content may not, and here is what happens instead.

The gate sits before generation

Module 3 sorted information into public, fictional, internal and sensitive. The gate is where that sort becomes an action.

It belongs at step 2 of the workflow frame — before anything is pasted anywhere, because after that the decision has already been made.

The privacy gate

PRIVACY GATE

Before any content enters a prompt:

1. Is any of this personal, confidential, or regulated?
       no  -> proceed
       yes -> continue

2. Can it be substituted without losing the task?
       yes -> substitute, mark what was substituted, proceed
       no  -> continue

3. Could the person be identified from what remains?
       (small team, rare condition, single named site)
       yes -> do not use the tool for this
       no  -> continue

4. Does an approved tool exist for this category of data?
       yes -> use only that tool
       no  -> do not use the tool for this

Record: what was substituted, and who decided.

Step 3 is the one people skip

Removing a name is not anonymisation when the details identify the person anyway.

"A team member in the two-person finance office who was absent last week" names someone. So does a rare condition in a small cohort. If re-identification is plausible, substitution has not worked.

Decide the category once, not per task

Deciding under time pressure produces inconsistent decisions.

Agree in advance which categories of information never go into which tools, write it down, and make the gate a lookup rather than a judgement. That is what makes it survive a busy week.

Mini practice

Take three real tasks and run each through the gate.

For any that stop at step 3 or 4, write what you would do instead.

Then write your category list: what never goes in, regardless of task.

Mark complete