Should You Put Confidential Information into ChatGPT or Other AI Tools?

Generative AI tools such as ChatGPT can be extremely useful at work. They can help summarise documents, improve emails, analyse information, generate ideas and solve problems quickly.

But before typing information into an AI tool or uploading a document, there is one question every employee should ask:

Am I actually allowed to share this information with an AI tool?

The answer is not always straightforward.

What counts as confidential information?

When people hear the words "confidential information", they often think of passwords, trade secrets or highly sensitive company documents. In reality, the definition can be much wider.

Confidential or sensitive information might include:

• Internal financial figures
• Business plans and strategies
• Customer or supplier information
• Contracts and legal documents
• Employee records
• Unpublished research
• Pricing information
• Product plans or intellectual property
• Meeting notes and internal correspondence

Information does not have to be marked "Confidential" to be sensitive.

A useful question to ask is:

Would my organisation be comfortable with this information being shared with an external company?

If the answer is no, or even "I'm not sure", you should think carefully before entering it into an AI tool.

What about personal data?

Personal data needs particular care.

Names, email addresses, telephone numbers, employee information, customer records, financial details and other information connected to an identifiable person may all count as personal data.

Putting that information into an AI system is still a form of processing it. Organisations therefore need to consider their data protection responsibilities, including why the information is being used, whether using it is necessary and what safeguards are in place.

Simply removing someone's name may not be enough. A combination of other details could still make that person identifiable.

The risk of copying and pasting

Part of the appeal of AI tools is how easy they are to use.

Someone can copy an entire email, report, spreadsheet or customer complaint into a tool and type:

"Please summarise this for me."

The result might be excellent.

The problem is that the employee may also have shared company information outside the organisation without properly considering where it is going, how it will be processed, whether it will be retained and what terms apply to the particular AI service they are using.

Those details can vary significantly between AI products, account types and enterprise services. Privacy, security and data retention arrangements are not necessarily the same from one tool to another.

Employees should not be expected to work all of this out for themselves.

Organisations need clear rules

Telling employees to "use AI responsibly" is not enough on its own.

People need practical guidance that answers everyday questions such as:

What information can I enter into an AI tool?

What information should never be entered?

Which AI tools are approved for work?

Can I upload documents containing personal or confidential information?

Who should I speak to if I am unsure?

These rules should be clear enough for everyone to understand, not just people working in IT, legal or compliance roles.

Stop and think before you prompt

AI can still be extremely useful without being given every piece of information available.

Before entering anything into an AI tool, consider whether names, figures, customer details or commercially sensitive information can be removed.

In many cases, you can get the same help by using an anonymised example or a fictional scenario.

For instance, rather than uploading a confidential customer complaint in full, you could remove identifying details and sensitive commercial information, then ask the AI to help you structure a suitable response.

Most importantly, follow your organisation's AI policy and use tools that have been approved for work purposes.

A useful rule of thumb is this:

If you would not be comfortable sending the information to an unknown external recipient, do not automatically paste it into an AI tool.

Responsible AI use is not about stopping people from using AI. It is about making sure people understand what they are sharing, where that information may be going and when they should stop and ask for guidance before clicking "send".