PII is any information that identifies a specific person.
Names, emails, phone numbers, addresses and IDs all count.
Detect and redact it before it reaches a model or a log.
Tokenising PII lets you restore it after processing if needed.
GDPR and similar regulations make this a legal requirement, not a nicety.
PII is any information that identifies a specific person.
Names, emails, phone numbers, addresses, identifiers, and combinations that narrow to one person.
It arrives in model systems constantly, since users paste real data into prompts.
The obligations are legal rather than optional under GDPR and similar regimes.
Detect it before it reaches a model, a log or a third party.
Pattern matching catches structured cases such as card numbers and emails.
Named entity recognition catches names and places that no pattern will find.
Neither is perfect, so combine them and accept some leakage.
Redaction removes it, which is safe and can destroy the meaning of the request.
Tokenisation replaces each value with a placeholder that can be restored afterwards.
That keeps the text coherent while the real values never leave your system.
Redact in logs as well as in prompts, because logs are copied and kept.
Set retention deliberately, since data you no longer hold cannot be breached.
Check the provider's data policy, especially whether inputs may be used for training.
Anything remembered about a user is personal data with the obligations that follow.
One question on this card. Every option explains itself once you pick, right or wrong.
16 concepts in this module, then a graded test with every answer explained.