Page 169 - CyberSecurityEssentialsEnglish

TABLE 4-7: THE DATA LIFECYCLE BEFORE ENTERING AN AI TOOL

Stage The safety question

Do we need all of this data, or would a summary or a sample
Collection
suffice?

Transmission To which service, country, or provider will the data go?

Who processes it: a public tool, an enterprise account, or local
Processing
execution?

Storage Are the conversation and the files retained, and for how long?

Use for May it be used to improve the model or for training under the
improvement current settings?

Deletion Is there real deletion, or only removal from the interface?

Logs Are there copies in logs, connectors, or backups?

⚠ When not to use a public tool

Do not use a public tool with passwords or API keys, detailed health or financial data,
trade secrets, data about children or students, customer files or confidential contracts, or
high-impact decisions whose material your organization’s policy does not permit to be
sent to an external service. Use an approved enterprise tool, synthetic data, or a
summary that does not reveal individuals.

Where necessary, use safe alternatives: synthetic data, a de-identified sample, a statistical
summary, local execution, or an approved enterprise tool. The goal is not to block the task

but to redesign it so that it achieves its purpose with the least possible disclosure.

TABLE 4-8: EXAMPLES OF CLASSIFYING DATA BEFORE ENTRY

Category Examples Suggested handling

Officially published information, a general
Public May be used with content review.
service description.

Non-sensitive internal memos, ordinary Use an approved tool and do not
Internal
work plans. publish externally.

Contracts, customer data, performance Minimize it, prohibit public tools, and
Confidential
appraisals, unpublished code. apply permissions.

Passwords, API keys, detailed health or Enter only through a dedicated
Restricted
financial data, security secrets. system with strong controls.

168