Optional · Professional Practice · Lesson 03 of 08

How to Protect Client Privacy with AI

A drawing supplied for one small comparison can contain much more than that detail. Names, addresses and private project information travel with the file unless they are deliberately separated. The useful context for a task is often smaller than the document that contains it.

What information does the task actually need?

A redacted excerpt may answer the question without an entire client thread or plan set. Personal, contractual, confidential and security-sensitive details require classification and authorization before sharing. Credentials and tokens do not belong in prompts or generated artifacts. Approved accounts and settings should be chosen for the permitted information, not after the upload has occurred.

How should access and retention be managed?

Each tool needs a defined set of permitted data and only the access required for its task. Controlled references, retention settings and an agreed deletion or incident process make those boundaries usable in daily work. The responsible owner should be clear when the information or purpose changes. A reminder at the end cannot substitute for controlling what enters the system.

What if information may have been shared without authorization?

The workflow needs to pause while relevant files, prompts, settings and downstream outputs are preserved securely for assessment. The responsible privacy, legal or security process governs containment and notification. Exposed links or credentials may need revocation, with provider-supported removal pursued where available. Deleting a chat does not prove every retained copy is gone. Restart requires an authorized, minimum-necessary input and a correction to the failed control.

Sources and further reading

Try a defined task

AI data review

Decide what information can enter the task.

From the lesson into practice

How to Protect Client Privacy with AI

For client work

AI and the Design Process

The application depends on the actual professional task and evidence available.

Carry it forward in: A useful practice artifact or verified workflow.

A worked example

Replace the client name, address, faces, prices, and access details with neutral labels before asking AI to organize a project issue list; provide only the pages needed for that task.

What should be true before you move on?

A minimum-necessary data package processed through an approved account with authority, access, retention, deletion, incident, and notification requirements documented.

AI and the design process

AI data review

Decide what information can enter the task.

An editable file preserves these notes for reopening after leaving or refreshing. It stays on the device and is not sent to Inspire Hardware.

Project-specific decision

Know where general guidance stops.

Redaction helps but does not replace authority, a verified vendor path, or applicable privacy obligations.

  • Classify the data and confirm the client agreement, jurisdiction, permitted purpose, and minimum necessary fields.
  • Verify account controls, access, retention, training use, deletion, subprocessors, and incident response.
  • Do not proceed until the responsible privacy, legal, security, or client authority approves unresolved risk.

Explore the principle

Reviewed September 2026 · Inspire Hardware