At work, do not paste passwords, access keys, confidential client or company information, personal data about customers or colleagues, or regulated health and financial records into an AI tool unless your company has approved that tool for that kind of data. Even with an approved tool, share only what the task needs and strip out identifying details first. When you are unsure, check your company's AI policy or ask IT or security before you paste, not after.
Key takeaways
- Your company's AI acceptable use policy and its list of approved tools come first. Personal accounts and work data do not mix.
- Never paste credentials of any kind. There is no task where an AI tool needs your password or an access key.
- Removing names is not the same as anonymizing. A few details together can still point to one person.
- Contracts, NDAs and licenses can forbid sharing material even when it feels harmless.
- If you paste something you should not have, report it quickly. Deleting the chat does not undo the disclosure.
Why pasting into AI is different
Typing into an AI chat feels private, like writing in a notebook. In reality, you are sending data to a service run by someone else. What happens next depends on the tool, the account type and the settings. The provider may store your conversation, keep it for a set period, let staff review it for safety, or use it to improve its models. Business agreements often set different terms from free consumer accounts, but you cannot assume which terms apply without checking.
Regulators take these promises seriously. In a 2024 post, the US Federal Trade Commission warned AI providers that commitments about how customer data is used, including promises not to use it to train models, are enforceable wherever they are made, as explained on the FTC's technology blog. That is useful context, but it does not protect you from breaking your own employer's rules or a client contract. The safest assumption is that anything you paste has left your control.
The NIST Generative AI Profile lists data privacy as one of the main risks of generative AI, including leakage and unauthorized disclosure of personal or sensitive information. For an individual employee, the practical meaning is simple. Every paste is a small data-sharing decision.
The do-not-paste checklist
Use this list before you share anything with an AI tool at work. If an item applies, stop and check your policy or use a safer approach.
- Passwords, access keys and security codes, including login details, one-time codes, private keys, connection strings and screenshots that show any of them.
- Customer and patient personal data, such as names with contact details, account numbers, Social Security numbers, dates of birth, addresses and anything that identifies a real person.
- Health, financial and other regulated records, including medical information, payment card data, bank details, tax records and anything covered by specific laws or industry rules.
- Employee information, such as performance reviews, salaries, disciplinary notes, medical leave and hiring notes about named candidates.
- Confidential client material, meaning client files, deal terms and anything shared with you under an NDA or a confidentiality clause.
- Unreleased company information, such as financial results before announcement, merger plans, pricing strategy, product roadmaps and board materials.
- Proprietary code and technical details, including source code, system diagrams and security configurations, unless your company has approved a tool for that work.
- Licensed third-party content, such as paid research reports, subscription databases and other material whose license does not allow uploading to outside services.
- Legal matters, including documents in active disputes, investigations or anything a lawyer has asked you to keep confidential.
This is a general checklist, not legal advice. The exact rules for your role depend on your employer, your industry and the laws that apply to your data, so check your company policy and ask your legal or compliance team when a case is unclear.
Why removing names is not enough
A common shortcut is to delete names and assume the data is now anonymous. Often it is not. In a well-known study from Carnegie Mellon University, Latanya Sweeney estimated that 87% of the US population was likely unique based only on 5-digit ZIP code, gender and date of birth, as reported in her paper Simple Demographics Often Identify People Uniquely.
The same logic applies inside a company. "The regional manager in Denver who went on leave in March" identifies one person as clearly as a name does. A customer complaint that mentions a rare product, a town and a date may do the same.
When you need AI help with material about people, generalize the details as well as removing names. Replace exact dates with months or quarters, cities with regions, job titles with broad roles, and amounts with ranges, as long as the task still works. If the task only works with the identifying details, it probably belongs in an approved tool or should be done without AI.
Hidden data in files and screenshots
Uploads often carry more than you meant to share. Before you upload a file, look for these common hiding places.
| File type | What can slip through | What to check |
|---|---|---|
| Spreadsheets | Hidden tabs, hidden columns, filtered rows | Unhide everything or copy only the cells you need |
| Documents | Tracked changes, comments, previous versions | Accept or remove changes and comments |
| Slide decks | Speaker notes, appendix slides | Review notes and delete extra slides |
| Screenshots | Browser tabs, notifications, open emails | Crop tightly to the relevant area |
| PDFs and scans | Signatures, account numbers in headers | Redact before uploading |
A two-minute check here prevents most accidental disclosures.
Safer ways to get the same help
Following the checklist does not mean giving up on AI. In many cases you can get almost the same value with much less risk.
- Describe the structure instead of sharing the data. "I have a spreadsheet with columns for region, month and revenue. Write a formula that totals revenue by region" needs no real numbers.
- Use invented sample data that has the same shape as the real thing, then apply the result to the real data yourself.
- Paste only the paragraph you need help with, not the whole contract or report.
- Use your company's approved AI tool for work data, and use its business account rather than a personal one.
- Ask for a template or a method rather than a finished answer about a specific person or client.
What to do if you overshare
Mistakes happen, especially when you are moving fast. What matters is what you do next.
Report it promptly to your manager, IT or security team, following your company's process. Explain what you shared, which tool you used and when. Deleting the conversation may help with future storage, but it does not reverse the fact that the data was sent, so do not treat deletion as a fix. Early reporting gives your company the chance to act, for example by contacting the provider or informing a client if a contract requires it. Hiding a mistake usually makes it worse.
Frequently asked questions
Is it safe to use a personal AI account for work tasks?
Usually not for anything involving work data. Personal accounts are covered by consumer terms, which may allow longer storage or use of your inputs to improve the service, and your employer has no agreement with the provider. Use the tools your company has approved and keep personal accounts for personal tasks.
Can I paste information that is already public?
Public information, such as a published press release or a public web page, is generally lower risk. Be careful with mixed material, though, because a document that is mostly public can still contain a confidential note or a customer detail. Check your policy, since some companies still limit which tools you can use.
Does turning off chat history make AI tools safe for confidential data?
It can reduce how long data is kept or whether it is used for training, depending on the tool. It does not by itself make a tool approved for confidential or regulated information. Your company's policy and its agreement with the provider decide that, not a single setting.
Know the basics
Good data habits with AI come down to a few questions you ask before every paste. If you want to check how well you know them, the VeriLevel Foundation certification includes data and privacy alongside evaluating output and responsible use. It is an independent online exam, not an accredited or government credential, and it can help you spot the areas where a refresher on your company's policy would be worth the time.
