Privacy and data minimisation in AI applications

Learn in your browser · Chapter 01 of 06

You cannot minimise personal data until you have found it, and in an AI feature it spreads further than most teams expect.

This is general education, not legal advice, from primary sources read on 26 September 2026. The ICO (Information Commissioner's Office, the UK regulator) says data protection officers (DPOs) or other information governance staff should be involved in AI projects from the earliest stages. Involve yours early, and a solicitor when lawfulness, a contract or a transfer is in doubt.

Personal data, in the UK GDPR, is information relating to an identified or identifiable person, directly or indirectly, for example by name, identification number, location data or online identifier; the ICO says it covers living people only. Indirectly matters: a job, a street and a birth date together can point to one person.

Scroll sideways to see every column.

Learn in your browser · Chapter 02 of 06

Article 5 of the UK GDPR sets seven principles. Here they are, applied to one AI feature.

Scroll sideways to see every column.

The ICO's minimisation test: identify the minimum personal data you need for your purpose, and hold that much but no more. It says this does not mean processing none, and that you must not collect data on the off-chance it might be useful.

Lawful basis. Document one of Article 6's bases before you start. The ICO lists seven: consent, contract, legal obligation, vital interests, public task, legitimate interests and recognised legitimate interest (pre-approved purposes such as safeguarding and crime prevention). Most need processing to be necessary, which the ICO says fails if less personal information would reasonably do. Special category data, such as health, needs an extra condition. The ICO says AI development and deployment are often best treated as separate purposes.

Transparency and rights. Under the UK GDPR, privacy information must state your purposes, lawful basis, retention periods, recipients and any applicable automated decision-making information. Subject to applicable exceptions, provide it when collecting data directly from the individual. For data obtained from another source, provide it within a reasonable period after obtaining it and no later than one month. If you use that data to communicate with the individual or disclose it to someone else sooner, provide the information at the latest at that first communication or first disclosure respectively. Do not assume an exception applies: check its conditions in the ICO guidance. That guidance is under review after the Data (Use and Access) Act 2025. The ICO says rights reach training data, inputs, outputs and possibly the model, and a request is not excessive merely because AI makes it harder.

Learn in your browser · Chapter 03 of 06

Settle three questions before personal data reaches an AI service: how risky is it, who is responsible, and where does it go?

A data protection impact assessment (DPIA) records the risks processing poses to people and how you will reduce them. Article 35 requires one before processing likely to result in high risk, and always for: systematic and extensive automated evaluation of people, including profiling, on which decisions with legal or similarly significant effects are based; large-scale special category or criminal offence data; and large-scale systematic monitoring of publicly accessible areas. The ICO's list adds, among others, AI and other innovative technology combined with a European criterion such as sensitive data or vulnerable people, and automated decisions on access to a service. Its AI guidance says AI will trigger a DPIA in the vast majority of cases; if you decide otherwise, document why.

An AI DPIA should describe data flows, human involvement, less risky alternatives and trade-offs such as accuracy against minimisation. Start early, ask your DPO, keep it live, and consult the ICO before processing if high risk remains that you cannot sufficiently reduce.

Controller or processor? A controller decides the purposes and means of processing; a processor acts on its behalf (Article 4). In the ICO's example of a model offered through an API, the provider is likely a controller for training it and a processor for a client's queries. Contract labels do not decide this. The ICO says you are likely a processor if you have no purpose of your own and act only on a client's instructions, so check whether a provider uses your prompts to improve its models. A processor needs a contract meeting Article 28.

Transfers. The ICO's three-step test: does the UK GDPR apply; are you initiating a transfer to an organisation outside the UK; is it a separate legal entity? Three yeses make a restricted transfer, and giving access counts. It needs UK adequacy regulations, a safeguard such as the ICO's International Data Transfer Agreement plus a transfer risk assessment, or an exception. Otherwise, do not transfer.

Learn in your browser · Chapter 04 of 06

Drop the fields you do not need, then redact identifiers from the free text that remains.

Article 25 requires data protection by default: only personal data necessary for each specific purpose should be processed. Allowlisting keeps named fields and drops the rest, even fields added later. Redaction swaps identifiers in free text for labels such as [EMAIL], using regular expressions (text patterns) and a list of known names. It works on language, so it guesses.

Save this as redact.py in a new folder and run it (use python3 on macOS and Linux). It needs only the standard library and was tested with Python 3.12.10 on Windows 11.

"""redact.py: minimise and redact a ticket before it goes to an AI service. All data invented."""
import re

KEEP = ["ticket_id", "category", "message"]  # the field allowlist
NAMES = ["Ada Fictional", "Sam Sampleton", "Jo Testperson"]  # invented customers
PATTERNS = {
    "EMAIL": r"[\w.+-]+@[\w-]+(?:\.[\w-]+)+",
    "PHONE": r"(?:\+44\s?|\b0)\d{2,4}\s?\d{3,4}\s?\d{3,4}\b",
    "NINO": r"\b[A-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b",
    "POSTCODE": r"\b[A-Z]{1,2}\d[A-Z\d]?\s?\d[A-Z]{2}\b",
}


def minimise(ticket):
    return {k: v for k, v in ticket.items() if k in KEEP}


def redact(text):
    counts = {}
    rules = [("NAME", re.escape(n)) for n in NAMES] + list(PATTERNS.items())
    for label, pattern in rules:
        text, n = re.subn(pattern, f"[{label}]", text)
        if n:
            counts[label] = counts.get(label, 0) + n
    return text, counts


if __name__ == "__main__":
    ticket = {"ticket_id": "T-1001", "name": "Ada Fictional", "birth_date": "1961-03-03",
              "category": "repairs", "message": "Ada Fictional here, boiler broken. Ring 07700 900123 "
              "or email ada@example.com. Postcode XX1 1XX, NI QQ 12 34 56 A."}
    kept = minimise(ticket)
    print("Kept fields:", list(kept))
    print(*redact(kept["message"]), sep="\n")

python redact.py
Kept fields: ['ticket_id', 'category', 'message']
[NAME] here, boiler broken. Ring [PHONE] or email [EMAIL]. Postcode [POSTCODE], NI [NINO].
{'NAME': 1, 'EMAIL': 1, 'PHONE': 1, 'NINO': 1, 'POSTCODE': 1}

re.subn returns the new text and the number of replacements. Log such counts, never the originals, or your logs become a second copy. Now test it: save this beside it as test_redact.py.

"""test_redact.py: what does redact() catch and miss? All messages invented."""
from redact import redact

CASES = [  # (message, text that must go, text that must stay)
    ("Email sam@example.org or ring 020 7946 0321.", ["sam@example.org", "020 7946 0321"], []),
    ("Jo Testperson, NI QQ123456B, XX2 3XX.", ["Jo Testperson", "QQ123456B", "XX2 3XX"], []),
    ("Mobile +44 7700 900456, office 0113 496 0789.", ["7700 900456", "0113 496 0789"], []),
    ("My neighbour Kit Imaginary parks badly.", ["Kit Imaginary"], []),
    ("Ada says the boiler failed.", ["Ada"], []),
    ("Write to ada at example dot com.", ["ada at example dot com"], []),
    ("I am the only wheelchair user in Block C.", ["only wheelchair user in Block C"], []),
    ("Nurse, born 3 March 1961, district XX9.", ["3 March 1961", "XX9"], []),
    ("Router model XR7 2AB keeps rebooting.", [], ["XR7 2AB"]),
]

total = leaked = lost = 0
for i, (text, must_go, must_stay) in enumerate(CASES, 1):
    out = redact(text)[0]
    left = sum(s in out for s in must_go)  # True counts as 1
    broken = sum(s not in out for s in must_stay)
    total, leaked, lost = total + len(must_go), leaked + left, lost + broken
    print(i, "MISS" if left or broken else "ok  ", out)
print(f"{total} to remove: {total - leaked} caught, {leaked} leaked; {lost} over-redacted")

python test_redact.py
1 ok   Email [EMAIL] or ring [PHONE].
2 ok   [NAME], NI [NINO], [POSTCODE].
3 ok   Mobile [PHONE], office [PHONE].
4 MISS My neighbour Kit Imaginary parks badly.
5 MISS Ada says the boiler failed.
6 MISS Write to ada at example dot com.
7 MISS I am the only wheelchair user in Block C.
8 MISS Nurse, born 3 March 1961, district XX9.
9 MISS Router model [POSTCODE] keeps rebooting.
13 to remove: 7 caught, 6 leaked; 1 over-redacted

Seven of thirteen caught, six leaked, one product code destroyed. The cases were chosen to be hard, so this is no general miss rate: measure yours on invented test data that looks like your real traffic.

Learn in your browser · Chapter 05 of 06

The misses are the lesson: each is a kind of identifier that pattern matching handles badly.

Scroll sideways to see every column.

Case 8 shows the risk the ICO calls linkability, sometimes known as the mosaic or jigsaw effect: details that may seem not enough to identify someone in isolation can identify them when combined, with each other or with other records. It asks you to apply a motivated intruder test: what could someone determined to identify people reasonably do with this data and anything else available?

Pseudonymised is not anonymous. Pseudonymised data cannot be linked to a person without extra information kept separately; the ICO says it is still personal data, and only anonymous information, where no one is reasonably identifiable, is outside the law. Our pipeline keeps ticket_id, so every redacted message links back to its ticket. Knowingly or recklessly re-identifying de-identified personal data without the controller's consent is an offence (Data Protection Act 2018, section 171), subject to defences.

Models can leak too. The ICO describes attacks that infer training data, and the European Data Protection Board, whose guidance the ICO says is not binding under the UK regime, said in December 2024 that models trained with personal data cannot, in all cases, be considered anonymous.

Learn in your browser · Chapter 06 of 06

Accountability means showing your working. Finish with the records a reviewer will ask for.

Record of processing. Article 30 requires one. The ICO says organisations with 250 or more employees must record all processing, and smaller ones any that is not occasional, is likely to risk people's rights, or involves special category or criminal offence data. An entry:

Scroll sideways to see every column.

Retention. The ICO says the UK GDPR sets no specific time limits: you decide, justify, document and review them, and deletion should put data beyond use, backups included. This dry run applies an invented 30-day rule to three log entries.

"""retention.py: a dry run. It lists log entries past retention and deletes nothing."""
from datetime import date

TODAY = date(2026, 9, 26)  # fixed so the output repeats
KEEP_DAYS = 30  # an invented rule for redacted prompt logs, not a legal limit
LOG = {"L-01": date(2026, 8, 20), "L-02": date(2026, 8, 27), "L-03": date(2026, 9, 20)}

for entry, written in LOG.items():
    age = (TODAY - written).days
    print(entry, f"{age} days:", "would delete" if age > KEEP_DAYS else "keep")

python retention.py
L-01 37 days: would delete
L-02 30 days: keep
L-03 6 days: keep

It deletes nothing; a real job should delete only after someone checks a dry run. For security, see the NCSC's Guidelines for secure AI system development.

Data flow. The ICO says an AI DPIA should describe data flows, and asks technical teams to record every movement and store of personal data. A text diagram will do; this invented one has problems planted.

Tenant form --(name, email, phone, flat, message)--> Ticket database (UK)
Ticket database --(whole ticket)--> redact.py
redact.py --(ticket_id, category, redacted message)--> AI service (outside UK)
redact.py --(original and redacted text, kept forever)--> debug.log
AI service --(summary)--> Ticket database
AI service --(prompts, may train its models)--> Provider logs
Ticket database --(nightly copy)--> Backups (kept 7 years)