A data-privacy checklist before you use generative AI with company data

Generative AI tools are easy to start using. That is their strength, and also the risk: the moment someone pastes a customer list, a contract or a payroll file into a chat window, company data has left the systems you control. Before you roll generative AI out to a team, it pays to work through a short checklist. None of this replaces legal advice, so check the data-protection rules that apply to you in every country where you operate and hold data.

Know what data goes where

Start by classifying the data people are likely to use. A simple three-level split works for most companies:

• Public: marketing copy, published prices, website content.
• Internal: process documents, meeting notes, internal reports.
• Confidential or personal: customer records, employee files, financial details, contracts and anything that identifies a person.

Then map each tool against those levels. Which AI services are approved? Where do they process and store data? Does the provider use your inputs to train its models? A consumer chat app and a business deployment configured inside your own environment are very different things, even when the interface looks the same. Write the answer down, for example: "internal data may go into tool A; confidential data stays inside our own systems until approved."

Control who can access what

An assistant grounded in your documents is only as safe as its permissions. If it can read the whole shared drive, anyone who can ask it a question can, in effect, read the whole shared drive.

• Connect AI to your data with the same access rules your staff already have, not through one all-powerful account.
• Use company accounts with single sign-on rather than personal sign-ups.
• Remove access promptly when people change roles or leave.
• Keep API keys and connectors in a managed place, not in scripts on someone's laptop.

Decide on retention and logging

Two questions are often missed: how long is data kept, and who can see the history?

• Retention: find out how long each tool stores prompts, uploaded files and outputs, and choose the shortest period that still lets you work. Delete test data after a pilot.
• Logging: keep a record of who used which tool, with what data and when. Logs help you investigate a mistake and show that the rules are followed. They contain sensitive data themselves, so protect them like any other confidential record.
• Outputs: generated summaries and drafts can contain personal data too. They fall under the same rules as the source material.

Give staff clear, short guidance

Most data leaks involving generative AI are not attacks. They are well-meaning people taking a shortcut. A one-page guide does more than a long policy nobody reads. It should cover:

• Which tools are approved, and for which data levels.
• What never goes into a tool that is not approved for it, for example ID numbers, passwords, health or salary details and client contracts.
• How to remove names and identifiers when an anonymised example is enough.
• That AI output is checked by a person before it reaches a customer.
• Who to ask when in doubt, and how to report a mistake quickly and without blame.

Repeat it during onboarding and in short refresher sessions, in the languages your team works in.

Start small, then scale

Run a pilot with one team and one workflow, review the logs and the questions that come up, and adjust the rules before a wider rollout. In our projects we usually set these controls up at the start, alongside the workflow itself, so privacy is designed in rather than added later. If you would like help mapping your data and choosing a safe setup, book a free 30-minute consultation or describe your challenge to the AI solution designer on the homepage.