AI Privacy
What Data Should You Never Put Into Public AI Tools?
Public AI tools can be useful, but a convenient text box is not automatically a safe place for business information.
The short answer
Do not enter information that you would not knowingly disclose to an external provider unless you have assessed the tool, contract, settings, access, storage, training use and your legal obligations.
Information to keep out by default
- Personal information: names, addresses, contact details, identifiers and customer histories.
- Sensitive information: health, biometric, racial, religious, political or other protected information.
- Employee information: performance, remuneration, disputes, medical details and applications.
- Financial information: bank details, card data, unreleased accounts, payroll and tax records.
- Contracts and legal material: confidential terms, disputes, privileged advice and negotiation positions.
- Security information: passwords, API keys, access tokens, system architecture and vulnerability details.
- Commercial information: pricing models, supplier terms, product plans, customer lists and acquisition discussions.
- Third-party intellectual property: content, code or data you do not have permission to provide.
Why “no names” may not be enough
A document can identify a person or business through context even after obvious names are removed. Dates, job titles, locations, order details and unusual events may make re-identification possible.
Questions to ask before using a tool
- What exact information will be entered?
- Is every field necessary?
- Will inputs be stored or used for training?
- Who can access the information?
- Where is it processed?
- Can it be deleted or exported?
- What happens if the output is wrong?
- Who approves the final use?
The OAIC’s commercial AI privacy guidance emphasises due diligence and continuing accountability for the organisation using the tool.
Safer alternatives
Use synthetic examples, remove unnecessary fields, summarise rather than upload, use approved enterprise settings where appropriate, restrict access and retain human review.
This article provides general business information, not financial, legal, tax, employment, privacy or technology advice. Obtain advice appropriate to your circumstances.