Data & Infrastructure
How do we handle PII in RAG systems?
Redact at ingestion (before embedding) using an approved PII detector; keep a reversible redaction map only if legally required. Ensure the vector store inherits source data classification and supports per-record deletion for data-subject rights. If PII must be visible in outputs, apply output-side redaction as a defense in depth.
Last reviewed:
More on Data & Infrastructure
Related on this site
Framework dimensions
Whitepapers
Browse the full FAQ for 170 answers, or start a free GenAI maturity assessment to see where your organisation stands.