Data Classification, Minimization, and Anonymization
CoreApply data sensitivity, privacy, and regulatory considerations · Difficulty 2/5
Explanation
Much Associate work involves real business data, some of it sensitive, so the first practical step is to classify it.
The Classification Spectrum
| Class | Examples | Handling |
|---|---|---|
| Public | Marketing copy, published reports | Freely shareable |
| Internal | Internal memos, non-sensitive process docs | Shareable within org bounds |
| Confidential | Strategy documents, unreleased plans | Restricted, needs care |
| Regulated | Personal data, financial records, health information | Subject to law/policy; typically requires minimization or anonymization before use |
Minimize and Anonymize
When policy restricts regulated personal data, the practice is to remove or mask personal identifiers -- names, account numbers, other PII -- before sharing data with Claude. This is the concrete mechanism behind the 'find the compliant path' principle: anonymization is usually what turns a blocked task into an allowed one.
Follow the Underlying Regulations
Data-protection laws (GDPR/CCPA-style regimes) constrain what personal data may be processed and how, and any usage must align with them and with contractual obligations the organization has made to its own customers or partners. Classification tells you what you're holding; regulation and contract tell you what you're allowed to do with it.
Why 'Don't Retain' Is Not a Control
Instructing a model 'don't retain this' does not satisfy a policy control. The control that actually matters is not exposing the regulated data in the first place -- i.e., minimizing or anonymizing before the data ever reaches the model, not attaching a request about what happens to it afterward.
Common exam traps
- 'Upload it but tell Claude not to keep it.' Telling the model not to retain data is not a substitute for anonymization or policy compliance.
- Skipping the analysis entirely when anonymization would have made it compliant -- abandoning value unnecessarily is also a wrong answer.
Key Takeaways
- Classify data as public, internal, confidential, or regulated before deciding how to handle it
- Regulated data (personal, financial, health) typically requires minimization or anonymization before sharing with Claude
- Anonymization is the concrete mechanism that turns a blocked task into a compliant one
- Data-protection laws (GDPR/CCPA-style) and contractual obligations constrain processing beyond internal policy alone
- Telling the model 'don't retain this' is not a policy control -- preventing exposure upfront is
Glossary Terms
Related Concepts
Choosing the Compliant Path Over Abandonment or Rule-Breaking
The correct move for a borderline case is usually to find the compliant adjustment, not to proceed as-is or abandon the task
Organizational Governance and Escalation Paths
Organizations layer governance (approved tools, allowed data, review steps, escalation paths) on top of the AUP
Incognito Mode: A Feature Control, Not a Classification Answer
Incognito mode excludes a standalone chat from Memory and from visible history; it has no effect inside Projects