This lesson is being recorded
Every video of this course is being uploaded to my YouTube channel. Subscribe so you do not miss it.
Bruno Ashford @brunoashfordSubscribeModule 11 · Lesson 11.2 · 11 min
Customer Data and Privacy
Handle personal data carefully when working with agents, with the UK GDPR, EU GDPR and US state privacy laws in mind.
Use ← → to move. The marker highlights text and the pencil draws on the slide; navigation locks while you annotate. Undo removes the last mark, Esc exits.
1Map what personal data you actually give the agent
List every file or connector the agent touches and what personal data is in it. Mark anything sensitive: health, financial, children, legal matters, identity documents. You cannot protect what you have not listed.
Scan this business folder and list every file that appears to contain personal data (names, emails, phone numbers, addresses, health, financial or legal details). Do not copy the data itself into your answer. For each file give: path, type of personal data, whether it looks sensitive, and whether the agent actually needs it for any skill we use.2Minimise before you share
Give the agent the least data that does the job. For a marketing analysis, remove names and emails and keep postcode and purchase history. For an aging report, the client name and amount are enough, not the contact's home address.
Create a copy of crm/crm-export.csv called crm/crm-export-minimised.csv that keeps only customer ID, city, first purchase date, last purchase date and total spend. Remove names, emails, phone numbers and street addresses. Do not modify the original file.3Know your plan's data terms
Check which Claude plan you use and read its data and privacy settings, including whether your conversations may be used to improve models and how long data is kept. Business plans usually offer stronger commitments than personal ones. If you process sensitive or regulated data, confirm the terms and agreements you need before you start, not after.
4Separate client data by folder
Keep each client or data set in its own folder and start Claude Code in the narrowest folder that contains what the task needs. An agent that is working on Client A has no reason to be able to read Client B.
5Write the rules into CLAUDE.md and your policy
Add a short privacy section to your CLAUDE.md so every session follows it, and copy the same rules into the AI use policy in lesson 11.6. Back the most important ones with deny rules.
Add a Privacy section to our CLAUDE.md with these rules: never paste personal data into web searches or external tools, never copy customer data between client folders, use the minimised CRM file unless I say otherwise, and flag any request that involves health, financial or legal details before acting.Your CRM export has names, emails, phone numbers and sometimes much more: health notes at a dental clinic, case details at a law firm, income figures at an accounting practice. The moment you give that file to an AI tool, you are processing personal data with a new supplier. Your customers never think about it. Regulators do.
This lesson is not legal advice, and privacy law differs by country and state. It gives you sensible business habits that fit the spirit of the main regimes your customers are likely under: the UK GDPR, the EU GDPR, and the growing list of US state privacy laws such as California's. For anything specific to your sector, speak to a qualified privacy lawyer or your professional body.
Key points
- Giving a file to an AI tool is processing personal data.
- List it, minimise it, separate it.
- Check your plan's data terms before using sensitive data.
- This is good practice, not legal advice; speak to a lawyer for specifics.
Avoid
- Exporting the whole CRM when three columns would do.
- Mixing several clients' data in one working folder.
- Assuming a personal plan has the same terms as a business plan.
- Pasting customer details into prompts that search the web.
A private dental clinic in Manchester wanted Claude Code to analyse which treatments drove repeat visits. Their first instinct was to export the full patient list, including medical history notes. Instead they exported patient ID, age band, treatment codes and visit dates only. The analysis was just as useful, found that hygienist visits were the strongest predictor of repeat treatment, and not a single piece of health information left the practice management system.