Mortanas AcademyHow should personal data be protected in AI workflows?
Start by establishing purpose, lawful basis, necessity and accountability for the processing; then minimise what reaches the AI system. Prefer anonymised, aggregated or synthetic material where it genuinely meets the task, restrict access, set retention limits and understand whether a provider stores or uses inputs. Assess risks to people before deployment, especially for profiling or consequential decisions. Provide meaningful information and routes for review, correction and objection where applicable. This is general operational guidance, not legal advice.
A practical five-step workflow
- Define purpose, legal context, data subjects and accountable owner.
- Remove fields that are not necessary for the task.
- Verify provider terms, storage location, training use and deletion controls.
- Apply access control, encryption, logging and a retention schedule.
- Assess impact, test leakage and maintain review or correction routes.
Worked example
A learning assistant uses pseudonymous progress categories instead of names and free-text notes; raw records remain in the protected source system and expire under the existing schedule.
Risk controls
- Copying entire records for a narrow task
- Assuming a provider never retains inputs without checking
- Using inferred sensitive traits in decisions
Primary and authoritative sources
Use the current version of each primary source for critical, legal or regulated decisions.
- UK ICO artificial intelligence and data protection guidancecy.ico.org.uk
- European Commission data protection rulescommission.europa.eu
Continue with the detailed Mortanas guide
This answer brief gives the decision pattern. The linked implementation guide expands the workflow, measures, failure modes and operating notes.
Questions about this answer
How should personal data be protected in AI workflows?
Start by establishing purpose, lawful basis, necessity and accountability for the processing; then minimise what reaches the AI system. Prefer anonymised, aggregated or synthetic material where it genuinely meets the task, restrict access, set retention limits and understand whether a provider stores or uses inputs. Assess risks to people before deployment, especially for profiling or consequential decisions. Provide meaningful information and routes for review, correction and objection where applicable. This is general operational guidance, not legal advice.
What should be measured?
Percentage of AI data fields with documented necessity, retention, access and provider-handling decision.
What evidence should be retained?
Keep the approved purpose, input or source references, relevant system and prompt version, human reviewer, corrections and the final outcome. Retention must follow the organisation’s privacy, security and records rules.
When should a human intervene?
Human review should increase when the output can affect rights, safety, money, reputation, access or an irreversible external action, or when evidence is missing, conflicting or uncertain.
Scope: Educational guidance, not legal, medical, financial or security advice. Verify current primary rules and obtain qualified advice for regulated decisions.