Skip to content

PII, privacy and data handling in LLM apps

  • System design
  • Asked often
  • About 1 h 45 min to learn
  • 3 vetted resources
Build a plan that includes this

What this topic covers

Any assistant over customer or employee data will see names, emails, health or financial details, and that data can leak into prompts, provider logs, traces, vector stores and eval sets. Enterprise and forward-deployed interviews ask “how do you handle PII in prompts and logs?” and expect more than “we redact it”. A strong answer starts with data minimisation, then layers detection (regex and checksums plus NER models), masking or reversible pseudonymisation at the boundary before the provider, logging metadata instead of raw text, short retention and deletion requests, access controls on retrieval, and an honest statement that detection misses things so it is risk reduction, not anonymisation.

Builds on

You’re ready when you can

What interviewers check, from the resources below.

  • List the places PII ends up in an LLM system: prompts, retrieved context, provider logs, traces, vector stores, eval sets
  • Explain why masking at the gateway is different from masking in your traces
  • Explain why field-level masking keeps traces debuggable
  • Say why short retention is a backstop rather than the main control
  • Name three ways PII leaks from an LLM app
  • Explain why a “don’t reveal this” instruction in the system prompt is not a control
  • Pick mitigations for training data versus runtime prompts
  • Run the analyzer and anonymizer on text and read the detected entities
  • Explain how regex, checksums, context words and NER combine in one recognizer
  • Choose between replace, mask, hash and encrypt operators for a given use

What to study, in order

Each link opened and checked by hand; the date says when.

  1. Start here

    PII masking patterns for LLM applications (opens in a new tab)

    Langfuse · 30 min · Free · checked 22 Oct 2026

    Why
    Interviewers want to hear where PII can leak and where you’d stop it. This guide lays out four enforcement points and the trade-offs of each, which is the shape of a good answer.
    What to read
    Read “TL;DR”, then all four layers: masking in the SDK, enforcing at ingestion, filtering at the gateway before the model provider, and detecting what got through. Finish with “Choosing your combination”.
    What to skip
    Skim the Langfuse-specific configuration snippets; the architecture is what matters. The FAQ is optional.

  2. Free alternative

    LLM02:2025 Sensitive Information Disclosure (opens in a new tab)

    OWASP GenAI Security Project · 15 min · Free · checked 22 Oct 2026

    Why
    The industry checklist for how LLM apps leak sensitive data, short enough to read before an interview and easy to cite.
    What to read
    Read “Common Examples of Vulnerability”, all six groups under “Prevention and Mitigation Strategies”, and the three example attack scenarios.
    What to skip
    Skip “Reference Links” and “Related Frameworks and Taxonomies”.

  3. Go deeper

    Presidio (opens in a new tab)

    GitHub · data-privacy-stack · 45 min · Free · checked 22 Oct 2026

    Why
    The open-source PII detector and anonymiser most teams reach for. Running it once shows you what detection catches and what it misses, which makes your interview answer concrete.
    What to read
    Read the README’s “How it works” and “Main features”, then follow the linked “Getting started” guide to run presidio-analyzer and presidio-anonymizer on a few sample prompts. Look at the pseudonymisation and the “PII Masking LLM calls using LiteLLM proxy” samples in the docs.
    What to skip
    Skip presidio-image-redactor, presidio-structured, the CLI and the Docker deployment docs.

Companies that test System design most

Put PII, privacy and data handling in LLM apps in your plan

Tell us your interview date and hours a day; it lands on the right day, in the right order.

Build my plan