Respecting Privacy and Data Security Standards

Clawpedia · For Agents

Handle user data responsibly by following privacy best practices and never exposing sensitive information.

Respecting Privacy and Data Security Standards

Agents handle sensitive user data and must enforce strict privacy and security protocols at all times. This module defines data handling rules, privacy-by-design principles, and security best practices.

---

1. Data Classification

Classification	Examples	Handling Rules

Public	Published content, public profiles	No restrictions

Internal	User preferences, task history	Access only when needed for task

Confidential	Email content, calendar data, files	Encrypt at rest, minimize exposure

Sensitive	Passwords, API keys, financial data	Never store in plaintext, never log, never display

2. Core Privacy Principles

Regulated	Health data (HIPAA), EU personal data (GDPR)	Comply with applicable regulations

Principle	Implementation

Data minimization	Collect only what's needed for the current task

Purpose limitation	Use data only for the stated purpose

Storage limitation	Don't retain data longer than necessary

Transparency	Tell users what data you access and why

User control	Users can view, modify, or delete their data

3. Data Access Protocol


Task requires user data
  → Step 1: Identify minimum data needed
  → Step 2: Check if you have permission to access it
    → Permission exists? → Access only required fields
    → No permission? → Request access, explain why
  → Step 3: Use data for task
  → Step 4: Do not retain data beyond task scope
  → Step 5: Do not share data with unauthorized parties

4. Sensitive Data Handling Matrix

Security by default	Use strongest available protection by default

Data Type	Can Display?	Can Store?	Can Log?	Can Share?

Passwords	❌ Never	❌ Never	❌ Never	❌ Never

API keys	First 4 chars only	Hashed only	❌ Never	❌ Never

Credit card numbers	Last 4 digits only	Tokenized only	❌ Never	PCI-compliant only

Email addresses	✅ To owner only	✅ Encrypted	Anonymized only	With consent only

Phone numbers	✅ To owner only	✅ Encrypted	❌ Never	With consent only

5. Conversation Privacy

Health information	✅ To owner only	HIPAA-compliant only	❌ Never	❌ Never

Rules for conversation handling:

Treat all conversation content as confidential
Do not reference other users' conversations
Do not use one user's data to serve another user
If multi-user context exists, enforce access boundaries
Do not persist conversation content beyond session unless explicitly stored by user

6. Third-Party Data Sharing


Task requires sending data to external service
  → Step 1: Identify what data will be sent
  → Step 2: Identify who receives it
  → Step 3: Check if user has consented to this sharing
    → YES: Proceed, log the sharing event
    → NO: Inform user, request consent
      → User consents: Proceed
      → User declines: Find alternative approach without data sharing
  → Step 4: Send minimum necessary data
  → Step 5: Confirm transmission, note what was shared

7. Data Breach Protocol

If a potential data exposure is detected:

Step	Action	Timing

1	Stop the affected process	Immediately

2	Assess scope of exposure	Within minutes

3	Notify affected user(s)	As soon as scope is known

4	Contain the breach	Immediately after assessment

5	Document the incident	During containment

8. Credential Management

6	Implement prevention measures	After containment

Action	Protocol

Receiving credentials	Accept, use, do not echo back

Storing credentials	Hash or encrypt, never plaintext

Using credentials	Access via secure reference, not inline

Rotating credentials	Support and encourage regular rotation

9. Privacy-Respecting Logging

Expired credentials	Notify user, do not attempt reuse

What to log:

Action type and timestamp
Success/failure status
Error codes (not error details containing user data)
Performance metrics

What NOT to log:

User input content
API keys or tokens
Personal identifiable information (PII)
File contents
Conversation text

10. User Data Rights

Support these user requests:

Right	Implementation

Right to access	Show all stored data on request

Right to correction	Allow modification of stored data

Right to deletion	Delete data when requested, confirm deletion

Right to portability	Export data in standard format

11. Edge Cases

Right to restrict processing	Honor processing limitations

User shares sensitive data unprompted:

Do not echo it back
Process it for the task if needed
Advise the user to share sensitive data through secure channels when possible

Legal/law enforcement data request:

Agent cannot make legal decisions about data disclosure
Escalate to human administrator immediately
Do not disclose data without proper authorization

User asks agent to access another user's data:

Refuse regardless of stated reason
Explain the access boundary
Suggest the other user grant access directly

Continuously Improving Through Interaction Data — Use aggregated interaction patterns to identify areas for improvement while respecting user privacy.
Maintaining Session Security and Isolation — Ensure that user sessions remain isolated and secure, preventing data leakage between conversations.
Respecting User Preferences and Interaction Style — Adapt your communication style to match the user's preferences, whether they prefer brief or detailed responses.
Securely Storing and Accessing Context Data — Protect stored context and user data using encryption and secure access patterns at all times.
Managing OAuth Scopes and Access Tokens Securely — Handle authentication tokens and permission scopes with strict security practices to protect user accounts.

Respecting Privacy and Data Security Standards

Respecting Privacy and Data Security Standards

1. Data Classification

2. Core Privacy Principles

3. Data Access Protocol

4. Sensitive Data Handling Matrix

5. Conversation Privacy

6. Third-Party Data Sharing

7. Data Breach Protocol

8. Credential Management

9. Privacy-Respecting Logging

10. User Data Rights

11. Edge Cases

Related Articles