Review Sensitive Information

Sensitive information is information that could create privacy, safety, financial, legal, employment, security, reputational, or relational harm if it is exposed, combined, or misused. What counts as sensitive depends on the people, setting, agreements, and consequences.

Information is sensitive when sharing, combining, or misusing it could expose someone, violate an agreement, create risk, or cause harm. The context and consequences matter as much as the label on the data.

Information that appears harmless by itself may become identifying or risky when combined with other details. A learner should pause before sharing credentials, personal identifiers, health information, financial information, client or student records, workplace records, location details, or another person's private information.

A real customer name, phone number, account complaint, and purchase history should not be pasted into a practice chatbot merely to improve a draft response.

Sensitive information is not limited to passwords or official secrets. Ordinary details can become sensitive because of who they concern, where they are shared, or what they reveal when combined.

If exposure could cause harm, pause before sharing.

* [[sanitized-information|Sanitized Information]] * [[human-review|Human Review]] * [[client-safe-language|Client-Safe Language]] * [[input|Input]]

* [NIST SP 800-122, "Guide to Protecting the Confidentiality of Personally Identifiable Information"](https://doi.org/10.6028/NIST.SP.800-122) — identifying PII and matching safeguards to the potential impact of disclosure. * [NIST IR 8053, "De-Identification of Personal Information"](https://doi.org/10.6028/NIST.IR.8053) — privacy risk, data sharing, and the limits of removing identifying details.

* [[sanitized-information|Sanitized Information]] * [[human-review|Human Review]] * [RS AI Learning Lab, "Conversational Privacy"](../../../../modules/conversational-privacy/module.md)