Understanding the Invisible Risk
Many employees use public AI tools like ChatGPT or Gemini to summarise documents, draft emails, or even debug code, aiming to work more efficiently. The problem is, these actions can create invisible risks. When you input information into a public, consumer-facing
AI platform, you may lose control over that data. Unlike a secure company server, the terms of service for many public AI tools state that your input can be stored, reviewed, or used to train future versions of the model. This is like letting a stranger read your company's confidential files. An employee might paste text from a client contract to get a quick summary, unintentionally sending that private data outside the company's secure environment.
What Counts as 'Sensitive Data'?
The definition of sensitive data is broader than you might think. It’s not just about passwords or credit card numbers. In a business context, sensitive information includes a wide range of materials that should never be shared publicly. This encompasses personally identifiable information (PII) like names and contact details of clients or staff, financial data like revenue reports and pricing models, and protected health information (PHI). It also covers intellectual property such as unreleased product designs, proprietary source code, marketing strategies, and internal company memos or legal documents. Pasting any of this information into a public AI tool could lead to regulatory violations, contractual breaches, or the loss of a competitive advantage.
The Art of Writing Safe Prompts
The key to using AI safely is 'prompt hygiene' — treating every query as potentially public and sanitising it accordingly. This involves mastering the art of anonymisation. Before you send a prompt, carefully remove all specific and sensitive details. The goal is to provide the AI with enough context to understand the task, but not enough to identify any person, project, or specific company detail. This practice is also known as data minimisation, where you only share the data that is strictly necessary for the AI to perform its function. It’s a simple habit that can prevent a majority of accidental data leaks.
Use Placeholders and Generalise
A simple yet powerful technique is to replace confidential details with generic placeholders. Instead of writing, "Summarise this email from Ravi Kumar at Acme India about the delayed payment for Project Zenith," you should generalise it. A safer prompt would be: "Summarise this email from [Client Contact] at [Client Company] about a delayed payment for [Project Name]." This provides the AI with the structure and intent of your request without exposing real names, companies, or project codenames. By using placeholders like '[Client]', '[Employee Name]', '[Date]', or '[Location]', you preserve the context needed for a useful response while protecting the actual data from being processed or stored by a third party.
Check Your Company’s Policy First
Before you use any AI tool for work, your first step should be to understand your organisation's official policy. Many companies are establishing clear guidelines on which AI tools are approved for use and how they should be handled. Some organisations provide their employees with access to enterprise-grade AI solutions. These business-focused versions often come with contractual guarantees that your company's data will remain private and will not be used to train the public model. These tools operate within your company's secure environment. If your company doesn't have a clear policy, or if you are unsure, ask your IT or security department for guidance before proceeding. Never assume a tool is safe to use with work information.
