Public AI chatbots are useful, fast and often free. That is exactly why people paste things into them without thinking. Depending on the tool and the account settings, what you type may be stored, reviewed or used to improve the provider's models. For most everyday tasks, that is not a problem. For some information, it is.
Here are five types of information your staff should keep out of public AI tools, unless your organization has specifically approved a tool for that use.
1. Personal information about clients, members or patients
Names, addresses, birth dates, phone numbers, health details, case notes. This is the most common mistake, often made with good intentions: "Can you help me write a reply to Mrs. Smith about her file?" The fix is simple: remove or replace identifying details before asking for help.
2. Information covered by professional secrecy
Legal files, accounting records, counselling notes, anything your professional order requires you to protect. For these, the rule should be clear: never in a public tool, even anonymized, unless your organization has a tool approved for it.
3. Financial and banking details
Account numbers, card numbers, payroll, salaries, donor payment information. There is no everyday task where an AI tool needs these.
4. Passwords and access codes
It sounds obvious, but passwords end up in pasted emails, screenshots and configuration files. Ask staff to check what they paste, not just what they type.
5. Unpublished strategic documents
Draft budgets, contracts under negotiation, board discussions, grant applications not yet submitted. They may not contain personal information, but they are yours, and sharing them with an outside service is a decision management should make, not an individual.
A simple test for staff: "Would I be comfortable if this text were read by someone outside our organization?" If the answer is no, it stays out of public AI tools.
How to still get the help you need
- Anonymize: replace names with "Client A", remove dates and addresses, keep only the structure of the problem.
- Describe instead of pasting: "Help me write a polite reminder for an unpaid invoice" works without the invoice.
- Use an approved tool: some business plans offer stronger data commitments. Choose one, check its settings, and make it the official tool.
These rules work best when they are written down and explained, not just remembered. Our free AI use policy template includes a ready-made three-level classification you can adapt. You can also read how we handle this in projects on our data protection page.