How do you handle PII in AI systems?

What the interviewer is testing

Whether you can apply PII controls across data collection, model prompts, logs, storage, retention, and deletion while testing redaction effectiveness.

Answer framework

• Minimize the data sent to the AI system and include only fields the feature actually needs.
• Detect PII and redact or tokenize it before it enters prompts, logs, or other stored artifacts.
• Review provider data-retention and training terms before sending user data.
• Encrypt sensitive data at rest and in transit, restrict access, and apply retention limits.
• Support deletion requests and test redaction recall, since missed PII can expose sensitive data in logs.

Sample answer

I would treat PII as a data-minimization problem first, not only as a filtering problem. Before sending data to a model, I need to know whether the prompt actually needs each field, so I remove names, contact details, or account identifiers when they are not necessary. I would also review provider retention and training terms to confirm that submitted data is not retained or used in ways the application cannot accept. No model or provider setting makes unnecessary data safe to collect.

Next, I would detect and handle PII before it reaches prompts, vector stores, traces, or application logs. Detection can cover structured identifiers and patterns such as email addresses, phone numbers, and payment information. Redaction replaces sensitive values with placeholders, while tokenization can create reversible references when the application needs to restore a value later. I would prefer a deterministic rule for well-defined fields and a tested model-based detector for more varied text. Whatever I use, I would keep the original mapping outside the prompt and logs.

Security controls must cover the rest of the data lifecycle. I would encrypt data at rest and in transit, restrict access to sensitive mappings, apply retention limits, and build a workflow for deletion requests across the application, logs, and vector indexes. I would test redaction recall with labeled examples, including obfuscated and unusual formats, because missed PII can expose sensitive data in logs. I would also monitor detection failures and review any change to the pipeline with the same tests.

Likely follow-ups

What is the difference between redaction and tokenization? Redaction replaces the sensitive value so it cannot be restored directly. Tokenization substitutes a reference that a separate authorized system may map back to the original value when the application needs it.

How do I test whether my PII redaction works? I would use a labeled set that includes common identifiers, unusual formats, and obfuscated values, then measure how many sensitive values escaped into prompts and logs. I would review false positives as well.

What should a deletion workflow cover? It should identify the relevant application records, logs, vector indexes, and retained mappings so the deletion request can be handled consistently rather than only removing one database row.

Common mistakes

• Sending raw PII to the model and only redacting it from the displayed answer.
• Assuming provider retention and training terms remove the application's own privacy obligations.
• Keeping the original PII or a redaction mapping in the same logs as the processed content.
• Deploying a detector without testing how often it misses PII.

This article was prepared with AI assistance and reviewed before publishing. The original lives on the free question bank:

https://johnnnmai.github.io/ai-engineer-interview-questions/questions/how-to-handle-pii-in-ai-systems/?utm_source=devto&utm_medium=community&utm_campaign=how-to-handle-pii-in-ai-systems