Using AI at work safely: personal data and confidential information

What not to paste into AI, how to swap in fake values when you must, and what to check before you start.

Step by step

1. 1

   Know what must stay out

   Whatever you paste into a chat assistant is sent to the provider's servers. Depending on the service and your settings, conversations may be stored or used to improve the service — so anything that mustn't leave the company shouldn't go in at all.

   What to keep out, and what to do instead

   Type	Examples	Instead
   Personal data	Names with contact details, ID numbers, bank or card numbers, addresses	Fake values such as "Customer A" and "000-0000-0000"
   Customer and HR data	Customer lists, support logs, salaries, reviews	Describe the structure, or use a made-up sample
   Confidential business	Unreleased results, contract terms, product plans	A general question with numbers and names removed
   Access details	Passwords, API keys, server addresses	Never paste them (write "YOUR_API_KEY" in code)

2. 2

   Swap in fake values (masking)

   If the assistant needs to see the data to help, keep the structure and change the values. With the same fields and format, it can answer almost exactly as it would with the real thing.

   Real values and their replacements (example)

   Field	Real data (keep out)	What to paste instead
   Name	Minjun Kim	Customer A
   Phone	010-1234-5678	000-0000-0000
   Address	Unit 301, 12 ○○-ro, Mapo-gu, Seoul	Seoul
   Message	My order still hasn't arrived after three days	Keep as is (if it holds no personal data)

   I want to sort customer messages by type. Below is a sample with names and numbers replaced by fake values.
   Customer A / 000-0000-0000 / My order still hasn't arrived after three days
   Customer B / 000-0000-0000 / I'd like to change the account for my refund
   Customer C / 000-0000-0000 / My coupon won't apply
   Suggest criteria for sorting messages into delivery, refunds, payment and other.

   Here are criteria you could use.

   Delivery: late arrival, address change, damage — Customer A

   Refunds: refund requests, changing the refund account — Customer B

   Payment: coupons and discounts, payment errors — Customer C

   Other: anything that fits none of the above

   Check it

   • Before you send, skim what you pasted once more for any real names, numbers or addresses left behind.
3. 3

   Check the service settings and company rules

   Services differ in how long they keep conversations, whether they use them to improve the service (train models) and how you switch that off. Personal and business plans often have different terms. Before you start, read the data and privacy parts of the settings and the terms.

   If your company has rules for AI, they come first. If there's a list of approved services, stick to it.

   Check it

   • Have you checked the settings for chat history and for use of your data in training?
   • Is this an approved service, and is it clear how much work material may go into it?
4. 4

   Before you use the result

   AI output can also contain someone else's personal details or sentences lifted from elsewhere. For anything you share outside, check once more for personal data and for sentences that need a source.