Personal data in an LLM application creates three distinct risks that need three distinct fixes: sending it to a third-party API, logging it insecurely, and it accidentally leaking into any training data.
Three separate problems, three fixes
- Sending to a third-party API: check the provider's data-handling policy, and redact or mask PII before sending when the task doesn't genuinely require it.
- Logging: never log full prompts or responses in plaintext if they contain PII; log hashes, redacted versions, or restrict access to logs strictly.
- Training data: if you ever fine-tune on real user data, scrub PII from the dataset first — a model can memorise and later regurgitate specific training examples.
The habit that prevents most mistakes
Ask, for every piece of data flowing through the system, whether it actually needs to be there in that form. Most PII exposure in student projects comes from data flowing further than the task required, not from a deliberate decision to expose it.
See secrets management for student projects.
GenAI engineer and AI product builder with 2+ years shipping production-grade AI systems: RAG pipelines, fine-tuned LLMs, hybrid retrieval and multi-modal apps across vision, speech and OCR, architected end to end from ingestion to deployment. Leads engineering for SCULT INDIA's 14-member team, founded the 500+ member TechVerse Enclave community and has mentored 200+ students. Three hackathon first prizes: Changethon 2025 (IIT Roorkee), Product Genesis at Vividhotsava 2025 (CSJMU Kanpur) and BYTEBATTLE (MeetKats).
Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at colleges. Email pranjulrathour41@gmail.com.
