Are we sending the AI more personal data than the task needs?
Baseline: 2Enhanced: 13 controls
Who it applies to
Enter for every AI system. Some of its controls apply only where it processes personal data (B4). Go as deep as your system letter, and implement in your mode.
Why it exists
Send the AI only the personal data the task actually requires — and resist the habit of sending everything just in case. The path of least effort is to hand the model the whole record, the entire document, the full history, and let it find what it needs; and that habit quietly turns every prompt and every consulted document into a store of personal data far larger than the task justified. Minimisation is not only a legal principle here; it is the cheapest way to shrink the exposure created by every other part of the system, because data you never sent cannot leak, be logged, or be inferred from.
What to actually do
Strip personal data the task does not need before it reaches the model. Where a task needs a category of transaction but not the customer’s name, remove the name. Where it needs a symptom but not the identity, separate them. Build this reduction into how data reaches the model, so minimisation is the default path rather than a discipline each user must remember under time pressure.
Treat the prompt and the consulted document as data stores, and minimise them. Everything a user types and everything the system retrieves to answer becomes, in effect, stored personal data — in logs, in histories, in the provider’s systems. Minimise at the source: the less personal data enters the prompt and the retrieval, the less exists to protect everywhere downstream.
Put a data-loss-prevention boundary between your people and every external AI tool. The single technical control that most reduces the exposure of a small organisation: confidential material, personal data and protected attributes are detected and redacted or blocked before a prompt or an upload leaves the organisation, and the event is logged. It turns the prohibition in the Intellectual Property dimension into something the tooling enforces rather than something staff are asked to remember, and it is the mechanism through which the fairness dimension removes protected attributes before the AI sees them. It is often available as a feature of the productivity or security suite you already license.
Controls
Baseline2 controls
Control 153
Remove personal data not required by the task before it reaches the model.
Built into the data path as the default, not left to individual users.
How to implement it · Minimum rules
Per task, list the fields the model needs and drop the rest (e.g. classify a transaction: amount and category, not the customer's name)
Remove direct identifiers by default: names, identity document and account numbers, addresses, phone numbers, emails
Replace identifiers needed for linking with a reference code, and re-link outside the AI
Separate sensitive details from identity (e.g. the symptom without the patient's name)
Apply the reduction in the form, template, export or integration that feeds the model, not at each user's discretion
How to start
Per task, list the fields sent today, strike out those the task does not use, and change the export, template or form to omit them.
Evidence
The per-task list of permitted fields and the template or configuration that applies it.
Mode: light / standard / full
light
Staff use a fixed template or export without names and identifiers instead of pasting full records.
standard
The integration that feeds the model strips non-required fields by configuration, owned by the system owner.
full
A minimisation step in the data pipeline enforces per-task field allow-lists and is tested on each release.
Control 155
Operate a data-loss-prevention boundary with every external AI tool.
BaselinePreventiveall rolesthe whole organisation
What it is
Confidential material, personal data and protected attributes detected and redacted or blocked before prompts and uploads leave the organisation; events logged.
How to implement it · Minimum rules
Channels covered: browser, desktop applications, API integrations
Personal data: identity document numbers, IBAN, card numbers (with check-digit validation), customer phone numbers and emails in volume
Protected attributes: health, origin, age in recruitment
Confidential information: documents labelled "Confidential", source code, credentials and API keys (by pattern)
Action: block or mask before sending, tell the user why, log the event
How to start
Run it in monitor-only mode for 2–4 weeks to tune false positives, then switch to blocking.
Evidence
The rule set and the report of blocked events.
Mode: light / standard / full
light
Use the data-protection function already built into the tool itself or the corporate browser.
standard
IT runs a dedicated data-loss-prevention policy in the security tooling the organisation already licenses, covering all AI destinations, and reviews blocked events monthly.
full
The security function operates the boundary centrally across all channels, tied to the organisation's information labels and incident monitoring, and tunes the rules continuously.
Enhanced1 controls
Control 154
Minimise personal data in prompts and consulted content.
EnhancedPreventiveall rolesper system
What it is
The prompt and the retrieval are treated as data stores subject to minimisation.
How to implement it · Minimum rules
Prompt templates ask only for the details the task needs and warn against pasting whole records
Consulted sources exclude folders or fields with personal data the use does not need (e.g. personnel files out of a general assistant)
Documents are redacted before indexing where only their non-personal content is needed
Retrieval returns the passages needed, not whole files
A sample of prompts and retrieved content is reviewed each quarter for unnecessary personal data
How to start
Review which sources the system consults and remove the folders or fields holding personal data the use case does not need.
Evidence
The list of consulted sources with exclusions, the prompt templates, and the results of sample reviews.
Mode: light / standard / full
light
Limit the folders the tool can search, give staff a short prompt template, and check a sample of prompts each quarter.
standard
The system owner configures source exclusions and redaction before indexing and reviews samples each quarter.
full
Redaction runs automatically at indexing, and monitoring flags personal data in prompts or retrieved content beyond what is allowed.
Evidence
The minimisation rules in the data path; evidence that unnecessary personal data is stripped before processing; prompt and retrieval minimisation configuration. The DLP policy and its coverage of AI destinations; block and redaction logs.