Privacy controls for AI-enabled knowledge work

Map the data action

Choose one bounded workflow, such as using an assistant to summarize customer feedback. Describe what data enters, where it came from, whose information it contains, what the tool receives, what it produces, who can see the result, where it is stored, and when each copy is deleted. Mark transfers to vendors, plugins, retrieval systems, logs, exports, and downstream documents.

State the intended purpose and the people who could experience harm from the processing. Then classify each field as necessary, optional, transformable, or prohibited for this use. The analysis should consider free text and attachments, where hidden identifiers or sensitive context can remain after obvious columns are removed.

The NIST Privacy Framework provides a voluntary structure for identifying and managing privacy risk across organizational roles and the data-processing lifecycle. NIST describes privacy risk in terms of problems individuals may experience from systems operating with data. That supports a people-centered control design, but the framework is not a legal determination.

Sources: [1]

Write the privacy control card

For each material data action, record the business purpose, data owner, approved source, minimum fields, transformations, destination, access roles, retention period, disallowed uses, technical control, worker instruction, exception owner, monitoring signal, evidence location, and retest trigger. Name one failure the control is meant to prevent.

Use layers where consequences justify them. A worker instruction may be paired with field filtering, access restrictions, tenant boundaries, output review, logging, and deletion. Avoid claiming that redaction makes data anonymous unless a qualified review supports that conclusion in the specific context. Pseudonyms can still be linkable, and free text can reintroduce identity.

The UK Information Commissioner's Office publishes guidance on AI and data protection covering AI systems that process personal data and safeguards for people's rights and freedoms. It is jurisdiction-specific regulatory guidance; organizations should assess which rules apply and obtain appropriate legal or privacy advice.

Sources: [2]

Worked artifact: a synthetic feedback summary

Imagine a synthetic enablement team that wants an assistant to summarize open-text feedback from an internal workshop. The raw export includes names, email addresses, department, disability-accommodation comments, and narrative feedback. The privacy control card permits only feedback relevant to course design, prohibits direct identifiers and accommodation details, and requires a minimum group size before themes are shared.

The workflow creates a review copy that removes direct identifiers and routes sensitive lines to a restricted human reviewer rather than the assistant. The approved tool receives only the reduced text through a configured workspace. The output is checked against the reduced source for invented themes, overly specific quotations, and combinations that could identify a person. The team retains a control log, not the prohibited fields.

A test row containing an email address passes through the first transformation, so the control fails. The release is stopped, the free-text filter is changed, and a varied set of synthetic edge cases is rerun. Only after the evidence shows the test cases are handled does the owner approve a limited pilot. The example is synthetic and does not establish legal compliance or control effectiveness in another environment.

Test operation, not documentation

Verify the control with ordinary cases, boundary cases, malformed inputs, attachments, copied text, unauthorized roles, exports, and deletion checks. Confirm the evidence is readable by the reviewer and that an exception does not silently bypass the control. Retest after changes to purpose, data, vendor, model, permissions, integration, retention, or affected population.

Two Prune can create a controlled opportunity to observe how a participant handles sources, privacy cues, verification, and escalation in a simulation. It does not certify compliance, operate customer privacy controls, or replace jurisdiction-specific review.