Privacy protects information about identifiable people throughout collection, processing, storage, and disclosure. With generative AI, the practical question is whether sensitive data can be shared safely and under clearly defined controls. section 8.6 section 8.6.1
A usable privacy approach for AI analytics should:
- Identify personal and identifiable information, private communications, confidential financial or business information, intellectual property, and security-sensitive material. section 8.6.1
- Check who may access the AI, which documents and data it can use, and which regulatory constraints apply. section 8.2.1
- Agree how prompts and responses are stored, logged, reused for retraining, and separated between users or sessions. section 8.6
- Assign responsibility for privacy and security through roles such as a Data Protection Officer, privacy specialist, legal counsel, or information security officer. section 8.6.1
Before sending customer records to an external model
Treat names, private communications, financial details, and confidential business information as potentially sensitive. Confirm that sharing is authorized, communication is protected, provider storage and retraining practices are agreed, and separate user or session contexts are maintained. If the classification remains unclear, seek guidance from the organization supplying the data. section 8.6 section 8.6.1
A short AI use policy can make privacy expectations actionable by stating its scope, access rules, accountability, security requirements, transparency duties, and fairness principles. Higher-risk sectors may need stronger controls. section 8.2.1
