Use AI at work without leaking company or personal data: 12 rules

How do you use AI at work without leaking data?

Treat every prompt and every upload as a disclosure to a third party, and decide before you send it whether the task needs the sensitive part. In practice that means three habits: use a work account on a plan your organisation has approved, send as little personal and confidential detail as the task allows, and read what comes back before you use it. The twelve rules below turn those habits into things you can do on a Tuesday afternoon.

The risk is ordinary rather than exotic. In 2023, Samsung restricted generative AI on company devices after engineers uploaded internal source code to ChatGPT^[14]. That was an incident, not a regulatory decision, and we found no decision of a data protection authority fining a company for its employees’ use of a chatbot. The case still shows how a leak happens: someone in a hurry pastes something useful.

The 12 rules

The first four rules are about where you work, the next four about what you send, and the last four about what you do with the result.

Accounts and tools

1. Use the work account and the approved tool. The German data protection authorities’ joint guidance says employers should provide work devices and accounts so that staff do not have to use private ones, and that account names should not contain individual employees’ names^[1]. If there is no approved tool yet, ask for one instead of using a private account; the guide on shadow AI explains why bans tend to push use out of sight.
2. Know your plan before you paste anything about a person. Consumer and business plans of the same product differ in training defaults, contracts and data location. The plan note further down shows the differences as of 13 November 2026. If you do not know which plan you are on, assume the consumer rules apply.
3. Check the training and history settings, and know who controls them. The DSK recommends setting accounts so that inputs are not used for training and no history beyond the session is stored^[1]. Hamburg’s data protection authority adds that chat history should be switched off on shared accounts^[2]. On a managed work account an administrator usually owns these settings; do not change them without asking.
4. Be careful with feedback buttons. OpenAI says that if you give a thumbs up or down, the entire conversation may be used to train its models^[5]. Anthropic says that on consumer plans a thumbs up or down stores the full conversation for up to five years (de-linked from the account) and it may be used for training^[18]. A rating is a deliberate disclosure; do not click it on a chat that contains anything sensitive.

Prompts and uploads

5. Send only what the task needs. The GDPR principle of data minimisation says personal data must be adequate, relevant and limited to what is necessary for the purpose^[11]. A prompt that asks for a friendlier tone does not need the customer’s name, order number or address.
6. Mask first, then send. Replace names, numbers and addresses with consistent placeholders or realistic stand-ins, and keep the mapping on your side. This is pseudonymisation (US spelling: pseudonymization): data that can no longer be attributed to a person without additional information that is kept separately^[12]. The table below shows what to replace for each data type.
7. Look beyond names. The DSK says that removing names and addresses is regularly not enough, because the context can still make a person identifiable^[1]. A job title, a rare diagnosis, a date and a town together can point to one individual. Reread the masked text as a stranger would.
8. Treat an upload as a paste of everything in the file. Documents carry more than the visible page: other pages, comments, tracked changes, headers, footers and metadata. Before uploading, remove what the task does not need, or work from an extract. For files you must send, see how to pseudonymise data before it reaches an AI chat.

Results and judgement

9. Keep secrets and special categories out. Health data, data revealing political opinions, religious beliefs, trade-union membership or sexual orientation, and similar categories are subject to a general prohibition unless a specific condition applies^[13]. Credentials, keys and professional secrets do not belong in a chat at all (see the never-paste list below).
10. Read the output and own it. Hamburg’s authority lists checking the results and leaving decisions to humans among its recommendations^[2], and the DSK says decisions with legal effect on a person should in principle be taken by humans who have real discretion, not by a rubber stamp^[1]. Do not forward AI text that you have not read, and do not rely on figures, quotes or legal citations you have not verified.
11. Do not use a general chat tool to judge people. Ranking applicants or evaluating employees with a chatbot can fall into the employment use cases that the AI Act lists as high-risk^[19], with obligations that start on 2 December 2027^[15]. Ask your data protection officer before you try it. Also avoid asking a tool to link a named person to information it produced: the Baden-Württemberg authority treats linking an output to a named person as a new processing operation^[3].
12. Ask, and report mistakes early. If you are unsure whether something may go in, ask before sending. If you have already pasted something you should not have, tell IT or your data protection officer the same day, with the tool, the account and roughly what the content was. Early reports can be handled; hidden ones cannot.

Rules 1 to 12 also support a legal duty. Providers and deployers of AI systems must take measures to support the AI literacy of their staff; that duty has applied since 2 February 2025^[15] and was reworded, not removed, by the Digital Omnibus on AI^[16]. A short briefing on these rules can be one such measure.

What should you never paste into an AI chat?

Keep the following out of any chat, whatever the plan, unless your organisation has explicitly approved a tool and a process for that exact data type.

The list is a starting point. Your own policy should add what is specific to your sector and name the exceptions and who can grant them.

What should you mask first?

Mask the items that identify a person or a business directly, and then the combinations that identify indirectly. The table shows a practical order of work. Replace each item consistently, so that “Client A” always means the same client within a prompt, and keep the key out of the chat.

Pseudonymised data stays personal data for whoever holds the key^[12], so masking lowers what the provider receives without making your own processing disappear. A pseudonymisation tool can do the replacing and the restoring for you: Ainym’s browser extension, currently in closed beta with pilot teams, detects personal data on your own device and shows every match for you to confirm before anything is sent. No automatic detection finds everything, so a human check before sending stays necessary with any tool. The background is explained in pseudonymisation vs anonymisation.

Which plans keep your data out of model training?

As a rule, business plans say they do not train on your inputs by default, and consumer plans depend on a setting. The table summarises what the providers say on their own pages, as checked on 13 November 2026. Plans and terms change often, so open the linked page before you rely on a cell.

Two cautions. First, “no training” does not mean “no processing”: the provider still processes and stores your inputs to answer you, under its retention rules. Second, a training setting is not a contract. For personal data you also need a data processing agreement and a legal basis, which is the subject of Is ChatGPT GDPR compliant? and the provider-by-provider comparison of ChatGPT, Copilot, Claude and Gemini.

Where does the data go, and what do you decide before sending?

After you press send, you cannot see where the prompt is processed or stored, and you cannot call it back. What you have is the provider’s documentation and, on a business plan, a contract. Those are commitments with documented limits. OpenAI, for example, describes residency as storage at rest for eligible customers, with regional processing as a separate option^[4]. Google describes human review of a subset of chats in the consumer Gemini app^[10]. The plan table above is therefore a statement of what the provider promises, not something you can verify yourself.

The practical consequence is a change of order. Settings and plans act on the future: switching off training does not delete chats that are already saved^[5]. So the decision that counts is the one before sending: does this task need the name, the number, the address? If not, leave it out or replace it. That is data minimisation^[11], and it is the only step in this guide that works whatever the provider does afterwards. Rules 5 to 8 are where it happens. For the full picture across providers, see where your data goes when you use an AI assistant.

What should team leads and data protection officers do about it?

Turn the rules into something people can find and follow. A short policy, an approved tool list and one named contact do more than a long prohibition. Hamburg’s checklist for chatbot use recommends internal rules, involving the data protection officer, business accounts without private use, strong authentication, checking outputs and training staff^[2].

Where employee data or works council rights are involved, bring in the data protection officer and employee representatives early; the DSK suggests considering a works or service agreement^[1].

Next practical step: pick the three tasks your team gives to AI most often, check what personal or confidential data each contains, and write the mask-or-skip decision for each on one page. Definitions of the terms used here are in the glossary.

More specific guides: Microsoft Copilot and the GDPR, Claude and the GDPR, EU AI Act obligations for companies that use AI, DPIA for AI tools and, if something does go wrong, what to do after pasting personal data into ChatGPT.

This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.