How should personal data, sensitive data, trade secrets and credentials be protected across prompts, retrieval, memory and tool chains?

In plain language

Think of your house key. Giving the key once to a trusted person does not mean you should paste its photograph into every notebook. The more places information is copied, the harder it becomes to control, update and delete.

Why this matters

Unnecessary copies increase the risk of leakage, unauthorised reuse, a wrong-person match and incomplete deletion. A model answer may be correct even though it was reached using confidential data that was not needed.

Do not confuse

• Personal data concerns an identified or identifiable person; its precise legal scope depends on the applicable jurisdiction.
• Sensitive or special-category data refers to classes requiring greater protection because of potential harm.
• A trade secret or access credential need not be personal data, but still requires strict protection.
• Access for retrieval does not imply permission to reuse the data for training.
• Event logging, caching, memory retention and export are separate processing activities.

What should you do?

1. Inventory every data path and copy from the prompt through to tool output.
2. For each data field, define purpose, owner, authorised roles, retention period and deletion route.
3. Remove unnecessary fields before collection and use masking, redaction or pseudonyms where possible.
4. Provide passwords, API keys and similar secrets at execution time through a secure secret manager rather than embedding them in a prompt.
5. Restrict access to retrieval, memory, tools and event logs through least privilege and detailed logging.
6. Verify retention, training use, transfer and deletion terms for data sent to an external provider.
7. Test deletion or restriction not only in the primary record but in derived copies and downstream systems.

How do you audit it?

• Which data goes to which system and provider, and for what purpose?
• Are unnecessary personal, sensitive or confidential fields present in the prompt?
• Were retrieval, memory, vector records, event logs and caches inventoried separately?
• Are access and secrets limited to the least authority required for the task?
• If data is reused for training or product improvement, are the basis and limits recorded?
• Can deletion of all relevant copies be verified when the retention period ends?
• Is there an incident and notification process for a breach or wrongful disclosure?