Minimal-data prompts

What information should you remove or transform before sending a request to a generative AI?

1250 € per session, excl. VAT

In short

This half-day course of 3 hours teaches participants to prepare useful requests without unnecessarily exposing personal or confidential data. Working with a fictitious case file, participants identify sensitive information, reduce the context shared and check the responses. They leave with corrected prompts and a reusable checklist.

Why this training?

Copying and pasting an email can expose far more than the question being asked: a signature, contact details, message history, commercial information or assessments of individuals. Identifying these elements before sending avoids confusing useful context with an accumulation of data. Removing names is not always enough: an unusual role, a precise location and a date can make someone identifiable. The course combines data reduction with checks on usefulness, to produce a usable response without retaining unnecessary details. Case study used throughout: The fictitious organisation Avelune Équipements wants to summarise a complaint to prepare a response. Its training case file contains invented contact details, an order number, personal comments, a negotiated price and an internal note. Participants must retain the useful facts without sharing the entire file. Application at work: During your next authorised use, apply the checklist before sending anything: objective, essential information, transformations and checking the result. Record only the categories removed, without copying the data, then have uncertain cases reviewed by the appropriate designated contact.

Objectives of this training

  • Identify personal, confidential and unnecessary data in content to be shared.
  • Distinguish between deletion, generalisation, pseudonymisation and anonymisation.
  • Rewrite a prompt, limiting the information to the stated need.
  • Check the risks of re-identification and the faithfulness of the response.
  • Decide whether to send, rework or suspend a request in accordance with internal rules.

Who is it for and what are the prerequisites?

Roles and tasks concerned

  • Staff using AI to rephrase emails, summarise documents or prepare responses.
  • Assistants and team managers who regularly handle personal or internal information.

Prior skills

  • Have already formulated a few simple requests to a generative AI.
  • Know the categories of documents you handle in your work and the available internal guidelines.

What you will work on

  1. Identify before copying

    Objective: Identify what the case file actually exposes. Personal data, trade secrets, internal comments and unnecessary information; indirect identifying clues.

  2. Reduce without distorting

    Objective: Build a minimal but sufficient context. Deletion, general categories, date ranges and pseudonyms; pseudonymisation remains reversible and does not amount to anonymisation.

  3. Check before sending

    Objective: Make a decision appropriate to the authorised context. Internal guidelines, recipients, attachments, history and terms of use to be checked. A confidentiality instruction does not constitute technical protection.

  4. Measure usefulness and exposure

    Objective: Assess quality after data reduction. Checking essential facts, invented details and reproduced information; locally reintroducing only the necessary references.

What you take away

  • Annotated map of the data in the fictitious case file.
  • Three data-minimised prompts with justification of the transformations.
  • Pre-submission checklist.
  • Comparison of responses and a justified decision on submission.

Method and assessment

  • Short instructional sessions followed by immediate practice using the ongoing case study.
  • Individual work followed by work in pairs, with peer review of the outputs.
  • Guided group discussion: what works, what needs correcting and what remains a human decision.
  • Preparation: Arrange access to a tool authorised by the organisation; no personal account may be used as an alternative. Consult the internal confidentiality rules; exercises use only fictitious or previously anonymised content.

Observable criteria: Direct identifiers and re-identification clues in the case file are identified. ; Every retained piece of information meets an explicit need of the task. ; No mapping table or excluded information appears in the submitted prompts. ; The response respects the essential facts and does not invent the removed details. ; The checklist records the deviations identified, the corrections and the final decision..

Frequently asked questions

Can you use a real case file?

Exercises are limited to fictitious or previously anonymised cases.

Is replacing a name enough?

No: locations, dates and roles can enable re-identification through cross-referencing.

Does a ‘do not retain anything’ instruction protect the data?

No. It replaces neither internal rules nor checking the service’s terms and conditions.

What should you do if a sensitive piece of data seems essential?

Suspend submission and consult the authorised designated contact rather than circumventing the restrictions.

Last updated: