Using AI at work without leaking sensitive data
What not to paste into AI tools, how consumer and business plans typically differ, and a quick checklist for reading any AI tool's data policy.
By the AiTrain editorial team · Reviewed under our editorial standards
The fastest way to turn a productivity win into a serious incident is to paste the wrong thing into the wrong tool. This guide gives you a practical rule set you can follow today, whatever assistant your organisation uses.
Key takeaways
- Treat any AI tool your organisation has not approved like a public website.
- Never paste personal data about customers, patients, students or employees into an unapproved tool.
- Business and enterprise plans often offer stronger data commitments than free consumer plans — but read the actual terms.
- When in doubt, remove names and identifying details first.
The traffic-light rule
Green — generally fine in any reputable assistant - Public information and your own general questions. - Drafts that contain no confidential details. - Generic templates ("a polite reminder about an overdue invoice").
Amber — only in tools your organisation has approved - Internal documents, strategy notes, unreleased product details. - Financial figures that are not public. - Code from private repositories.
Red — avoid unless a specific, approved process exists - Personal health information. - Government ID numbers, bank or card details, passwords, API keys. - Information about children. - Anything covered by a confidentiality agreement or legal privilege.
Consumer versus business plans
Many AI providers offer both free or individual plans and business or enterprise plans. Common differences — which you should always confirm in the provider's current terms — include whether conversations may be used to improve models, how long data is retained, administrative controls, single sign-on, and contractual commitments such as data-processing agreements. Policies change, so check the current version rather than relying on a blog post (including this one).
Five questions to ask of any AI tool
- Is my input used to train or improve the provider's models, and can that be switched off?
- How long are conversations and files stored, and can I delete them?
- Where is the data processed and stored?
- Who at my organisation can see what I put in?
- Is there a signed agreement covering this data?
If you cannot answer these, the tool belongs in the amber or red zone for anything sensitive.
Anonymise before you paste
You can often get the same help with identifying details removed:
- Replace names with roles: "Client A", "Employee B".
- Round or remove exact figures that are not needed for the task.
- Remove addresses, account numbers and dates of birth.
- Summarise the situation in your own words instead of pasting the original record.
Watch out for connected tools
AI features that can read your email, calendar or drive are powerful and need extra care. Content from an incoming email or web page can contain hidden instructions (so-called prompt injection) that try to make the assistant do something you did not ask. Review actions such as sending messages or sharing files before they happen, and keep permissions as narrow as the task allows.
For managers
Staff will use AI whether or not there is a policy. A short, clear AI use policy plus an approved tool is far safer than a ban that pushes usage into personal accounts. Training people on the traffic-light rule takes under an hour and prevents most of the problems we see.
This guide is general information, not legal advice. Your obligations depend on your jurisdiction, sector and contracts.