CCAO-F 6.2 — Data sensitivity and privacy

Four steps before you paste

ClassifyWhose data is this, and how sensitive?
MinimiseStrip anything the task does not need
Choose surfaceWork account, project, or incognito
Leave a recordSo the next person knows what was shared

Classify and minimise come first because they are free and entirely in your hands. The surface and the record only limit the damage of what you already sent.

What sensitive actually means

“Sensitive” is not a feeling; in Europe it has a legal shape worth borrowing even if you are nowhere near Europe. The GDPR defines personal data as any information relating to an identified or identifiable natural person — which is far broader than names. A staff number, a car registration, an unusual job title in a small office, all identify someone. Within that, Article 9 marks out special categories that get extra protection: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data, data concerning health, and data concerning a person’s sex life or sexual orientation.

Anthropic’s own advice is simpler and points the same way: even with privacy protections in place, avoid entering financial information, health records, passwords and confidential documents into chats. That is not a statement that Claude is unsafe. It is the ordinary professional instinct that you do not circulate what you do not need to circulate.

Category	Example in a normal working day	Default handling
Public	A published price list, a press release	No restriction
Internal	A draft team plan, meeting notes	Fine in a work account
Confidential	An unsigned contract, salary bands	Work account only; minimise names
Personal data	A customer complaint with their email address	Remove identifiers the task does not need
Special category	A sickness note, a union grievance	Do not paste; describe the situation instead
Secrets	Passwords, API keys, card numbers	Never, on any plan

Minimisation is the control that actually works

The GDPR’s Article 5 principles read like a checklist for using an AI assistant well. Data minimisation says personal data must be adequate, relevant and limited to what is necessary. Purpose limitation says data gathered for one purpose should not be quietly reused for another. Storage limitation says it should not be kept in identifiable form longer than needed. Accuracy, and integrity and confidentiality, complete the list, and Article 5(2) adds accountability — the organisation has to be able to demonstrate it did all this, which in practice means someone wrote something down.

Applied to a prompt, minimisation is unglamorous and extremely effective. Almost every real task works just as well on a de-identified version of the text. A complaint reads the same whether the customer is Mrs Patel of 14 Oak Road or “the customer”. A performance concern can be described without the employee’s name. The moment you do that, the whole second question — retention, training, who can see it — shrinks to something you do not need to lose sleep over.

The same task, minimised

Pasted straight from the inboxtext

Draft a reply to this:

"From: j.patel@example.com
Acct 4471-9920. I'm
furious. I was in
hospital after my
surgery and you took
three payments. My
number is 07700 900412
and I live at 14 Oak
Road, Leeds."

Minimised firsttext

Draft a reply to a
customer complaint.

Facts: three payments
were taken in error
during a period when
the customer was unable
to contact us. They are
angry and want the
money back quickly.

Tone: apologetic, plain,
no jargon. I will add
their name and account
details myself.

Nothing the task needs has been lost. The identifiers, the account number and the health detail are gone, and the request is actually clearer.

What happens to what you send

The second question still matters, and the answers differ sharply between a personal account and a work one. On consumer plans — Free, Pro and Max — a privacy setting controls whether your conversations are used to improve Claude. Where a user has opted in, Anthropic says only a small number of personnel involved in model training see conversations, and that the data is automatically de-linked from the user ID such as the email address before any review. Separately, conversations flagged by safety classifiers may be reviewed to detect harmful content and enforce policy, whatever the setting says.

Work accounts are a different legal arrangement. For Team and Enterprise, the relationship is governed by the commercial agreement between Anthropic and the organisation rather than the consumer terms, with Anthropic acting as a data processor on the organisation’s behalf. In GDPR language the controller is the party that decides the purposes and means of processing — your employer — and the processor acts on its instructions. The practical consequence for you is blunt: the organisation’s Primary Owner can request data exports that may contain conversations, uploaded files and usage patterns. A work chat is a work record.

Incognito chats are the narrow tool people reach for too broadly. Started from the ghost icon at the top right of a new chat, they are not saved to chat history, are excluded from Claude’s memory in both directions, are not searchable from later conversations, and are excluded from training datasets even when model improvement is switched on. They are available on every plan. What they are not is invisible: they are retained for thirty days by default, and on Team and Enterprise they still appear in organisational data exports and the Compliance API. They also cannot be used inside a project, and they open in the previous chat experience, so file creation and code execution are unavailable.

Which control fits the worry

What are you actually worried about?

Data shouldn’t be sent
Minimise the promptRemove identifiers before pasting — the only real fix
Training on my chats
Privacy settingModel improvement control on consumer plans
Don’t keep this thread
Incognito chatNo history, no memory; still retained 30 days
How long we store it
Retention policyEnterprise owners set a custom period

Each control answers a different worry. Reaching for incognito when the real problem is the content in the prompt solves nothing.

Worked example · An occupational health referral at a logistics firm

A depot manager needs to write a referral to occupational health for a driver who has been off with a back injury. He has the driver’s GP letter open and is about to paste it in to get help with the wording.

Classify. The GP letter is data concerning health — a special category under Article 9, and one of the categories Anthropic explicitly names as something to keep out of chats.
Stop and minimise. He does not paste the letter. He types the three facts the referral actually needs: a musculoskeletal injury, twelve weeks absent, the role involves lifting up to 25kg and long periods seated.
Ask for the shape, not the content. “Draft an occupational health referral covering the impact on these duties and the questions we should ask. Leave placeholders for the employee’s name and dates.”
Fill in offline. He pastes the draft into the HR system and adds the name, dates and clinical detail there, inside the system that is meant to hold them.
Record it. The referral file notes that an AI tool was used to draft the wording and that no clinical documents were uploaded.

Takeaway: He got the whole benefit — better wording, faster — with none of the exposure. The special-category data never left the HR system, so no setting, plan or retention policy had to be trusted.

Worked example · A complaints team that reached for the wrong control

A retail bank’s complaints team is told to use incognito chats for anything containing customer details, on the grounds that incognito chats “aren’t stored”.

What the policy assumed. That incognito means the conversation disappears and nothing is retained.
What is actually true. Incognito chats are kept out of history, memory and training, but are retained for thirty days by default, and on a Team or Enterprise plan they still surface in organisational data exports and the Compliance API.
The gap that opened. Because staff believed the chats vanished, they pasted more, not less — full account numbers and correspondence that would previously have been summarised.
The correction. The instruction was rewritten: strip account numbers, names and addresses before pasting, in any chat; incognito is for keeping one-off work out of your own history, not a licence to paste more.

Takeaway: A misunderstood privacy feature is worse than no feature, because it changes behaviour in the wrong direction. Check what a control actually does before you build a rule on it.

Regulatory considerations, in plain terms

You do not need to be a lawyer to use a handful of ideas correctly. The GDPR requires a lawful basis for processing personal data — consent, performance of a contract, a legal obligation, vital interests, a public-interest task, or legitimate interests. Nothing about using an AI assistant creates a new basis; if your organisation already had one for holding the customer’s complaint, drafting a reply is part of the same purpose, and if it did not, the assistant does not help.

Article 22 is the one to remember by name. It gives people the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects them. That is the regulation saying, in its own words, what the Usage Policy says about high-risk uses in 6.1: a person decides, not the machine. Other regimes have their own equivalents, and sectors add their own rules on top — health, financial services and the public sector especially.

A prompt checked before sending

Passes: No passwords, keys or card numbers anywhere in the textNever acceptable on any plan
Passes: Names, addresses and account numbers removedThe task reads the same without them
Check: No health, union, religious or similar detailSpecial category — describe it, don’t paste it
Fails: Only the documents the task needs are attachedTwo of the four uploads are irrelevant
Passes: Sent from the work account, not a personal oneKeeps it inside the organisation’s agreement
Missing: Someone could tell later what was sharedAccountability — write a line in the case file

Run this over the prompt, not over the product. Four of the six items are things you fix by editing the text in front of you.

Traps the wrong answers are built from

Tempting but wrong	Do this instead
Pasting the whole document because it is easier	Extract the few facts the task needs; minimisation is the only control fully in your hands.
Treating an incognito chat as a shredder	It skips history, memory and training, but is retained by default and still appears in work data exports.
Assuming a work account makes anything safe to paste	A work chat is a work record your organisation’s owner can export.
Putting special-category data — health, union, beliefs — into a prompt	Describe the situation in neutral terms and keep the document in the system built for it.
Relying on a setting nobody has checked	Confirm what the control actually does before writing a team rule on top of it.

You should now be able to

Classify the data in front of you as public, internal, confidential, personal, special category or secret.
Rewrite a prompt so it carries only what the task needs.
Say what incognito chats do and do not do, including retention and work-account exports.
Explain the controller and processor roles for a work Claude account in plain language.
Recognise when Article 22 or a special category is in play and escalate rather than proceed.

Data sensitivity and privacy