4 min
Contact centres deal with users’ personal data on a daily basis, ranging from identification details (such as full name, national ID and postal address) to financial and sensitive data, including health information, religious beliefs or political ideologies.
When artificial intelligence enters the equation – particularly with the use of chatbots for customer service – it is natural for customers to be concerned. In fact, PwC’s latest report shows that 80% of consumers are concerned about the future development of generative AI and its impact on data privacy.
Of the many myths surrounding this technology, we acknowledge that this is perhaps the most worrying of all. However, according to Termly research, 91.1% of businesses are willing to prioritise data privacy in order to increase customer trust and loyalty.
SECURITY PROTOCOLS IN CHAT CAN MATCH THOSE IN CALLS
When an IVR (Interactive Voice Response) system identifies a customer during a phone call, various security protocols are triggered to protect their data. Typically, the system encrypts the data as it is entered or dictated by the user, ensuring that it does not appear in the call recording or become visible to the agent.
Channel switching – where the customer interacts with a chatbot rather than an IVR – does not change the security measures in any way. AI-powered chatbots can apply the same privacy principles, ensuring encryption, masking and anonymisation of sensitive information.
HOW WE PROTECT NUMERIC DATA IN A CHATBOT
When interacting with a chatbot, numeric data remains protected by the same security standards. When a customer enters their insurance policy number, national ID or access code, the AI processes it securely using automatic masking and encryption.
➡️ User: I would like to check my insurance policy number 987654321.
➡️ Chatbot: Thank you, we have received your request. The policy ending in 4321 is active.
This ensures that data is never stored in clear text and can only be accessed through secure authentication and encryption processes.
HOW WE PROTECT SENSITIVE INFORMATION IN A CHATBOT
When a customer shares highly sensitive information, such as health details or religious beliefs, the AI needs to be trained to apply additional protocols that minimise risk. Chatbots can detect sensitive data and apply anonymisation, tokenisation and automatic deletion to ensure user privacy.
Here are six ways to protect sensitive data when customers interact with a chatbot.
6 METHODS TO PROTECT DATA IN AN AI-POWERED CHAT
1. DATA MINIMISATION PRINCIPLE
Customers should not be asked to provide sensitive information unless it is absolutely necessary.
For example, instead of asking “What is your disability?”, the chatbot could say “If you need specific assistance, please respond with ‘👍’ or ‘👎'”, ensuring that the user does not have to share personal information.
2. AUTOMATIC RECOGNITION AND USER WARNING
If a user types: “I have epilepsy, how do I manage my insurance?”, the chatbot can detect this and respond: “For security reasons, we don’t need you to share any medical information in this chat. Would you like to speak to a specialist agent?”
This prevents sensitive information from being stored unnecessarily in the chat.
3. REAL-TIME ANONYMISATION
When a chatbot collects sensitive data, it can be replaced with generic labels before storage.
For example, if a user types: “I’m a diabetic and want to know what coverage I have,” the database stores: “User inquiring about medical coverage”, ensuring that no specific medical details are recorded.
This method transforms the original message so that it contains no personally identifiable information. While the original structure is lost, the general intent of the query remains intact.
4. AUTOMATIC DELETION OF SENSITIVE DATA
A chatbot can be programmed not to store certain words or phrases that have been identified as sensitive data.
For example, if a user asks: “I have a chronic illness, how does this affect my life insurance?”, the chatbot will process the query without recording the specific medical condition and will only store: “User inquiring about life insurance terms”.
Unlike anonymisation, this method preserves the original message structure with minor adjustments. Instead of replacing sensitive data with generic labels, it simply removes them.
5. COMPLIANCE WITH THE GDPR AND THE EUROPEAN AI LAW
If sensitive data is essential (e.g. in health insurance cases), the chatbot must ask for explicit consent before storing or sharing the information.
For example, when a user starts a chat, the chatbot could greet them by saying: “To help you, we may need medical information. Do you agree to share it according to our privacy policy?”
6. ACCESS RESTRICTION AND TOKENISATION
If sensitive data needs to be stored, the best approach is to use a token instead of the actual data.
For example, if a user discloses that they have celiac disease, the database can store “medical condition #874632″, where only an authorised system can decode the actual condition. This prevents employees or unauthorised third parties from directly accessing sensitive information.
This method is particularly useful for organisations with multiple levels of data access, ensuring that no agent can view sensitive data without proper authorisation.
FINAL THOUGHTS
The same security protocols that protect data during a phone call apply when a customer interacts with a chatbot. AI in customer service does not change the rules of the game – it automates and strengthens the protection of personal data.
A well-configured chatbot can prevent users from sharing unnecessary information and ensure that sensitive data is not stored without consent.
DISCOVER THE SECURITY MEASURES WE IMPLEMENT AT ENREACH
Subscribe
Ask for a demo