3 Essential Measures for Securing Sensitive Data in Your GenAI Projects

As your organization begins to explore and implement the power of generative AI, a critical question emerges: how do you ensure your most sensitive data remains secure? The answer lies in a multi-layered approach that combines clear policies, robust technology, and strong governance. It’s not about choosing one solution but integrating several to create a comprehensive defense. Based on findings from 451 Research on how organizations are protecting data in the GenAI era, here are three essential measures every business should implement.

First and foremost is establishing Employee Training and Policies. Cited by 48% of organizations, this is the most common measure taken to secure GenAI usage. The human element is often the first line of defense—and the weakest link. Clear, accessible policies that define acceptable use, data handling procedures, and prohibited actions are non-negotiable. These policies must be reinforced with ongoing training that educates employees on risks like prompt injection, data leakage, and the dangers of entering sensitive corporate information into public AI models. A well-informed workforce is a security-conscious workforce.

The second critical measure is implementing Data Encryption, a top technical control for 40% of businesses. While policies guide behavior, technology is essential for enforcement. Encrypting sensitive data before it is ever used in any GenAI system provides a non-negotiable layer of protection. This ensures confidentiality and gives you ultimate control over your data, regardless of how or where the AI model processes it. Modern encryption, especially when managed by a hardware root of trust, allows data to remain protected at rest, in transit, and even during processing through technologies like confidential computing.

Finally, organizations must enforce Role-Based Access Controls (RBAC), a key measure for 25% of respondents. The principle is simple: not everyone needs access to everything. Implementing strong, granular access controls ensures that only verified users, applications, and AI processes can access specific datasets for legitimate purposes. When these controls are anchored by a Hardware Security Module (HSM), they become auditable and tamper-proof. This creates a verifiable log of who accessed what data and when, forming a crucial pillar of AI governance and regulatory compliance. By integrating these three measures, you can build a trustworthy and defensible foundation for all your GenAI initiatives. 

A multi-layered approach is essential. The most common measures leading organizations are implementing today are employee training (48%), data encryption (40%), and role-based access controls (25%).

Get a complete overview of GenAI security trends and how your peers are protecting their data. Explore our "GenAI & Quantum-Safe Security" infographic.

Overview

Tina Stewart

Chief Marketing Officer, Utimaco

Overview