Analyzing data with AI while protecting customer data: 5 layers of protection and a 10-step process

There are 2 common ways to get it wrong when using AI to analyze customer data.

The first is to paste the whole customer table, with names, phone numbers and purchase history, into a chat window and ask "analyze this for me." The second is to ban AI outright, which pushes staff to use it covertly through personal accounts, so the risk remains while the business can no longer see it.

The middle path is to classify the data, give the AI only what is needed in a minimized form, choose a processing location with clear commitments, and keep logs.

This article presents that approach as 5 layers of protection and a 10-step process, using Anthropic's data documentation (the "Data usage" page and its privacy center, read on October 21, 2026) as a concrete example of what an AI provider does and does not commit to, together with the Vietnamese legal framework as covered in Click Star's earlier articles.

This is reference information, not legal advice, and each AI provider has its own terms that must be read. Click Star already has articles on the personal data protection law and on what to do with a database; this one connects them to using AI.

Key points

• The biggest risk is not "AI" but data leaving your control: every prompt and output is sent over the network to the provider, and retention differs by account type. With Anthropic, a consumer plan with training allowed retains data for 5 years, with it off 30 days; commercial plans (Team, Enterprise, API) retain for 30 days and by default do not use inputs and outputs for training.
• Some data paths are easy to forget: session transcripts stored locally in plain text for 30 days, reports sent through the /feedback command retained for 5 years, and transcripts shared through a quality survey retained for up to 6 months with source code and file contents uploaded as is.
• The Law on Personal Data Protection, in effect since January 1, 2026, sets obligations on consent, transfers of data abroad (impact assessment, notifying the Ministry of Public Security, a binding agreement with the recipient), breach reporting within 72 hours and penalties of up to VND3 billion or 5% of revenue; using an AI service hosted abroad falls within what needs review.
• The 5 layers in order: classify data, minimize and aggregate before sending, anonymize or pseudonymize, choose the processing location and contract, and control with logs and a human reviewer.
• The most effective technique is to send structure rather than data: give the AI column names and a few synthetic rows so it can write analysis code, then run that code on the real data on your own machine.
• No technique removes risk completely: rule-based masking can miss things, hashing an email address does not turn it into anonymous data, and groups that are too small can still identify individuals.

Where data goes when you put it into AI

Take Anthropic's "Data usage" document as an example (this is the provider whose official documentation Click Star could read; other providers have different terms and need separate checks). According to this page, when using Claude Code, all prompts and model outputs are sent over the network, encrypted in transit with TLS 1.2 or later.

Model training. For Free, Pro and Max plan users, Anthropic gives a choice about whether data may be used to improve models, and when it is on, data from these accounts (including when using Claude Code) is used for training.

For commercial users (Team, Enterprise, API, third-party platforms), Anthropic does not train generative models on code or prompts sent to Claude Code under commercial terms, unless the customer actively chooses to provide data (for example the Development Partner program).

Anthropic's privacy center states the same principle for commercial products: by default it does not use inputs and outputs, the exception being when you submit feedback or bug reports or actively opt in.

Retention. Consumer plans: 5 years if you allow model improvement, 30 days if you do not.

Commercial plans (Team, Enterprise, API): standard 30 days; Zero Data Retention (no server-side persistence) is available to qualified Claude for Enterprise accounts, is not included in the standard plan and is enabled per organization by the account team.

In addition, the Claude Code application stores session transcripts locally in plain text under ~/.claude/projects/ for 30 days by default to resume sessions, adjustable with cleanupPeriodDays.

Side paths. The /feedback command sends a copy of the conversation history, including code, to Anthropic; transcripts shared through /feedback, /bug and /share are retained for 5 years.

If you choose "Yes" to the question allowing Anthropic to look at the session transcript after a quality survey, the transcript is uploaded; known API key and token patterns are redacted before upload, but source code, file contents and other conversation content are uploaded as is, and kept for up to 6 months.

Operational metrics, according to the documentation, do not include code, prompts or file paths. For cloud sessions and Remote Control, the session transcript is stored on the server to sync across devices, under the plan's retention policy.

Click Star's view. Three lessons for every provider follow from this example: ask for the default on training for the exact type of account your staff use (consumer and commercial differ), ask how long data is kept and whether there is a no-retention option, and ask about the side data paths such as feedback, local transcripts and multi-device sync.

Most important, know which type of account your staff are using, because a personal account and a business account are two very different protection regimes.

The Vietnamese legal framework to keep in mind

According to Click Star's earlier article on this law (compiled from analyses by EY Vietnam, Tilleke & Gibbins, Luật Việt An and VnEconomy, and needing to be checked against the original text), Law No. 91/2025/QH15 on Personal Data Protection has been in effect since January 1, 2026, together with Decree 356/2025/NĐ-CP guiding its implementation and Decree 330/2026/NĐ-CP on penalties from August 19, 2026. The points that bear directly on using AI to analyze customer data:

• Consent remains central: the purpose of processing must be clear, with a way to withdraw consent and a consent log. Giving customer data to an AI tool is a processing activity, and that purpose needs to be within what the customer has consented to or fall under a case the law allows.
• Transfers of data abroad are stricter: an impact assessment file for the transfer, notification to the Ministry of Public Security and an agreement binding the recipient's responsibility are needed. Many AI services operate abroad, so putting Vietnamese customers' personal data there needs to be considered under this rule.
• Sensitive data is broader, including behavior-tracking data on online services, and banking data in more detail.
• Breach reporting within 72 hours of discovery; responding to data-subject requests within 2 working days; deleting data within 20 days (30 days if a processor or third party is involved). If data has gone into many AI tools, finding it again to delete will be hard.
• Penalties: up to 5% of the previous year's revenue for violations on transferring data abroad, up to VND3 billion for other violations.

Click Star does not give legal advice. For high-risk decisions such as giving real customer data to an AI service abroad, ask a lawyer and check the original text.

The 5 layers of protection

Layer 1: classify the data

Divide data into 3 levels, as in the image at the top. Green (may be given to AI): aggregated data that identifies no individual, such as the number of orders per week and conversion rates by channel. Yellow (given only after minimization and anonymization): customer-level data with direct identifiers removed.

Red (not put into external AI tools): names with phone numbers, emails, exact addresses, identity documents, payment data, health data, original chat content with customers that has not been masked, and any sensitive data under the law.

This is a reference framework from Click Star; a business needs to adjust it to its industry and contracts.

Layer 2: minimize and aggregate before sending

Give only the columns that the question really needs. If the question is "which channel brings customers with high order value," the AI does not need customers' names.

The most effective technique is to send structure rather than data: give the AI the column names, data types and 5 to 10 synthetic rows, ask it to write analysis code (SQL, Python, a spreadsheet formula), then run that code on the real data on your machine or in your system.

This brings the AI's capability into the process while the real data never leaves where you control it. When you need the AI to read results, give it the aggregated table.

Layer 3: anonymize and pseudonymize

Drop direct identifier fields entirely (name, phone number, email).

For a customer ID that must be kept to join tables, replace it with a random temporary code and keep the mapping table somewhere separate, not sent to the AI. Reduce detail: an address becomes a province or city, a date of birth becomes an age group, a purchase date becomes a week.

For free text such as chat content, names, phone numbers, emails and addresses must be scanned and masked before sending, and a sample of the result checked by eye, because automatic masking rules can miss things, especially names and addresses written freely in Vietnamese.

Automatic masking rules always have edge cases, so treat this step as always needing a human check.

Three technical warnings: hashing an email does not make it anonymous data because the hash can still be linked to the right person if someone has the original email, so hashed data still has to be treated as personal data; groups that are too small (for example just 1 to 3 customers in a statistics cell) can still identify individuals, so small groups need merging; and combining several seemingly harmless fields (province, age group, purchase date) can be enough to identify a person.

Layer 4: choose the processing location and contract

Use a business (commercial) account rather than a personal account, because the defaults on training and retention differ as described.

Ask the provider 8 questions: does it use your data for training by default; how long does it keep it and is there a no-retention option (such as Zero Data Retention); where is data located and through which sub-processors; is there a data processing agreement and a breach-notification commitment; are there logs and administrative controls; how is data deleted when a customer asks; what security certifications exist; and is there an option to run on your own infrastructure.

When data is truly too sensitive to leave, consider a model running in a private infrastructure, accepting the trade-off in quality and cost.

In Europe, Opinion 28/2024 of the European Data Protection Board (EDPB), according to summaries by the law firms CMS and Hunton, holds that an AI model trained on personal data is not automatically anonymous; the level of anonymity must be assessed case by case.

That opinion does not apply in Vietnam, but it is a reminder not to treat "put into the model" as "made safe."

Layer 5: controls, logs and a human reviewer

Keep a list of AI tools that are permitted, who may use them and which type of data may go into each. Keep logs (who sent what, and when) at a level that does not contain the sensitive data itself. Have a person review results before they are used for decisions about customers, because AI can be wrong.

Turn off side data paths that are not needed (such as sending feedback with transcripts). Train staff: most incidents come from everyday actions, such as pasting data into a personal account.

A 10-step process for one analysis question

1. Write the business question and the decision that will rest on the result.
2. List the columns that are needed; drop every other column.
3. Classify each column into the 3 levels; red columns are dropped or handled in a later step.
4. Remove direct identifier fields; replace customer IDs with temporary codes and keep the mapping table separately.
5. Reduce the detail (province instead of address, age group instead of date of birth, week instead of day).
6. Merge groups that are too small; check that no statistics cell holds only a few customers.
7. Give the AI the structure and synthetic rows to write code, and run the code on the real data where you control it.
8. If you must give data to the AI, use a business account whose terms you have checked and give only the aggregated table.
9. The responsible person reviews the result, checking a few figures by hand before they are used.
10. Keep a log: the question, the data used, the tool, the reviewer; delete temporary data when done.

A 30-day plan

• Week 1: take stock of which AI tools staff are using, with what type of account and what type of data; draw a map of where customer data sits.
• Week 2: classify the data into 3 levels; write a 1-page rule on what may and may not go into AI.
• Week 3: choose a business AI tool, ask the 8 questions in layer 4 and record the answers; try the "send structure, not data" process on a real report.
• Week 4: train sales and marketing staff; name a responsible person; schedule a quarterly review.

What is not known

Click Star could read the official documentation of only one AI provider (Anthropic); other providers need separate checks, and terms change over time.

The Vietnamese legal part rests on summaries by law firms and press and needs checking against the original text, and it is unclear how the regulator will apply it to putting data into specific AI services. There is no equivalent measurement for Vietnam of the share of businesses leaking customer data through AI tools.

Masking free text in Vietnamese still needs a human check because no automatic method is guaranteed.

Common mistakes

1. Pasting the original customer table into a personal AI account.
2. Banning AI completely, pushing staff to use it covertly so the business can no longer see where data goes.
3. Believing that hashing an email or phone number makes it anonymous.
4. Believing an automatic masking tool catches every name and address in Vietnamese text.
5. Ignoring the side data paths: local transcripts, feedback with conversation history, multi-device sync.
6. Not knowing which type of account staff are using, then assuming commercial defaults apply to personal accounts.
7. Having no deletion process, so being unable to meet a customer's deletion request within the legal deadline.