Prompt hygiene: privacidad práctica para equipos que usan IA generativa

Generative AI created a new data-egress path: the prompt.

A user can paste a customer ticket, a contract or production logs into an external service in seconds.

Treat prompts as data flows

Document:

• tool;
• account type;
• allowed data;
• retention;
• subprocessors;
• admin controls.

Redact before sending

Replace identifiers whenever the task does not need them.

Bad:

Summarize this complaint from María López, ID..., bank account...

Better:

Summarize a customer complaint about delayed delivery...

No secrets

Block or explicitly prohibit:

• passwords;
• API keys;
• private keys;
• tokens;
• recovery codes.

Prefer managed accounts

Enterprise-managed tooling generally gives the organization more control than random personal accounts.

The exact controls still need verification.

Files need extra caution

Uploaded documents may contain hidden sheets, comments, metadata, signatures and third-party data.

Human review

AI output can be inaccurate or inappropriate. Do not turn a convenience tool into an automated decision maker without a proper risk analysis.

The practical objective is simple: approved tools + minimum necessary data + governance.

Full article: IA generativa y RGPD en la empresa.