How would you handle personal data in an LLM workflow that processes customer emails?

What the interviewer wants to hear

• Minimise what is sent; send only needed fields
• Detect and mask or pseudonymise PII before the call
• Use approved providers with suitable data terms and retention
• Protect logs, traces and eval sets too
• Check outputs for PII leakage

Model answer

I would follow data minimisation first: only send the parts of the email the task really needs. Before the model call, a detection step finds names, phone numbers, account and card numbers and replaces them with placeholders like [PHONE_1], keeping the mapping inside our system so we can restore values in the final reply if needed. The provider must be approved by legal and security, with suitable data processing and retention terms for our region. I would also protect the less obvious places: logs, traces, prompt playground history and eval datasets, which should be masked or synthetic. On the output side I would check that replies do not expose other customers' data. Finally, I document the flow so compliance teams can review it, and I test the redaction with tricky cases.

More medium Prompt Engineer questions

• How would you build an evaluation set for a prompt that writes replies to customer complaints?
• When would you split a task into a chain of prompts instead of one large prompt? What are the trade-offs?
• A marketing team wants all generated content to match their brand voice. How do you achieve consistency?
• How do you know when prompt engineering has reached its limit and another approach, such as RAG or fine-tuning, is needed?
• Write the outline of a system prompt for a banking support assistant. What sections would it include and why?
• Design the prompt and retrieval setup for a customer support bot that answers from a help centre. What choices matter most?
• How do you design tool definitions so an LLM agent uses them correctly?
• Your LLM feature works well but is too slow and expensive. How would you reduce cost and latency without hurting quality?
• How would you set up regression testing for prompts so changes can be shipped safely?