6.2 — Applying Data Sensitivity, Regulatory and Privacy Considerations

CCAO-F Domain 6 · Task 6.2

What You Need to Know

Sensitive material is anything an organisation should not hand to an outside service without a decision. A safeguard changes what leaves the organisation’s hands.

Recognising Sensitive Material

Names, addresses, dates of birth, reference and account numbers, health information, financial details, anything about children — plus categories about ownership and promises: duty of confidence, commercially confidential figures, third-party material governed by a contract.

The Ladder (Lowest First)

1. Remove — strip the identifiers and proceed
2. Anonymise or aggregate — cohorts instead of individuals, ranges instead of exact figures
3. Use an authorised route — sanctioned workspace under an agreement that covers this class of material
4. Seek authorisation — take the question to whoever owns the data or the policy (an action, not a refusal)

Abandonment sits at the bottom and is almost never keyed.

Why the Placebo Fails

The policy control is about what leaves the organisation’s hands, which happens at upload. Every placebo fails this way: telling Claude to forget, declaring the upload confidential, adding a confidentiality line, deleting the conversation. Nothing typed into the chat can retroactively govern what was uploaded.

Key Concept: Any option whose safeguard operates after the upload is wrong. No placebo is ever keyed. The keyed answer changes what goes in, not what happens afterwards.

Exam Traps

• Treating a confidentiality instruction or later deletion as the safeguard
• Escalating up the ladder when removal would do
• Clearing a document because it contains no names
• Dropping the analysis because personal data is involved