AI chatbots can summarize documents, brainstorm ideas, and draft communications. Privacy risk often begins when someone pastes information into a prompt without checking whether it should be shared with an external service. Products differ in data controls, retention, and terms; do not assume a conversation is automatically private or immediately deleted.
Keep these details out of ordinary prompts
- Credentials: passwords, one-time codes, recovery codes, private keys, and authentication links.
- Payment data: full card numbers, bank credentials, and unredacted financial records.
- Personal identifiers: identity documents, government ID numbers, home addresses, and full birth dates when unnecessary.
- Customer or employee records: contact details, health data, salaries, and other sensitive fields.
- Confidential business material: unreleased financials, contracts, source code, and trade secrets.
- Private conversations: another person’s messages or documents without a valid reason and appropriate permission.
A safer way to work
- Share only the excerpt or facts needed for the task.
- Replace names with generic labels and remove unnecessary identifiers.
- Use fictional records for testing rather than live customer data.
- Review history, retention, model-improvement settings, and approved business accounts.
- Check integrations: connected drives, email, calendars, and extensions may expose more data.
- Review output for confidential details and inaccuracies before forwarding it.
Questions to ask a provider
What information is collected? How long is it retained? Who can access it? Can administrators control use and deletion? What happens when an account closes? Which contracts and laws apply? If answers are unclear, use non-sensitive sample data until the service has been reviewed.
If you already shared sensitive information
If a password or access token was exposed, change or revoke it through the legitimate service and review account activity. Follow your organization’s incident process if company or customer data may have been disclosed. For financial information, contact the provider through an independently verified channel.
See the NIST AI Risk Management Framework and the ChatGPT data controls FAQ. For related workflows, read our AI tools guide.
Featured image credit: Philipp Katzenberger via Unsplash.
