Most data exposure through AI is not a hack. It is an employee, trying to get work done, pasting a customer list, a drawing, a contract, or a patient note into a tool the company has not approved. Add the data that flows through approved tools into logs, vendor systems, and outputs.
This guide shows a matrix of data classes against kinds of tool, follows data through five stages of an AI use, lists questions to bring to a privacy or legal lead about personal data, covers business-confidential, export-controlled, and intellectual property concerns, lists practical controls, and gives a worked data map with a near miss.
Privacy and data laws vary by place and change. This is not legal advice. Example data are illustrative.
Before You Start
The Easiest Way to Leak Data Is to Paste It
Most data exposure through AI is not a hack. It is an employee, trying to get work done, pasting a customer list, a drawing, a contract, or a patient note into a tool the company has not approved. Add to that the data that flows through approved tools into logs, vendor systems, and outputs. Data protection for AI is mostly the discipline you already need for any data, applied to a tool that makes it very easy to move text around.
Classify the Data
People cannot follow rules for classes of data that nobody defined.
Map Classes to Tools
Say which class may go into which kind of tool, and enforce it.
Minimize
Leave out what the task does not need. Mask what you can.
Know the Whole Path
From collection to deletion, including prompts, outputs, and logs.
Data Classes and Tools
| Class | Examples | Public AI tool | Approved enterprise tool | Private deployment |
|---|---|---|---|---|
| Public | Published brochures, public standards | Allowed | Allowed | Allowed |
| Internal | Internal procedures, non-sensitive meeting notes | With approval | Allowed | Allowed |
| Confidential | Customer data, supplier prices, designs, unpublished results | Not allowed | With approval | Allowed |
| Restricted | Personal and health data, credentials, export-controlled data, trade secrets, legal matters | Not allowed | Not allowed unless specifically cleared | With approval and controls |
This is an example. Use the AI Acceptable-Use Policy and Tool Register, which includes a matrix like this, and have legal, privacy, and security leads set your own. See the Data Classification entry.
Follow the Data Through Its Life
At each stage ask what could go wrong. In the prompt: is personal or confidential data included that need not be? At the vendor: is it kept, who sees it, and does it train the model? In outputs and logs: copies of the data now exist where access may differ. At the end: can you delete it, and do you need to keep it for records or a legal hold?
Personal Data
Where an AI use touches personal data, privacy law may apply, such as the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended, other US state laws, and sector rules such as HIPAA for health information in the United States. The rules differ and change. Questions to bring to your privacy or legal lead:
- Purpose and basis: is the new use compatible with why the data was collected, and is there a lawful basis?
- Minimization: can the task be done with less data, or with masked or de-identified data?
- Vendor role: is the vendor a processor under a contract that limits its use of the data? Are there agreements required, such as a business associate agreement for health data in the US?
- Transfers and location: where is the data processed and stored?
- Assessment: does the use need a data protection impact assessment or similar?
- Automated decisions: does the use make or shape decisions about people? Some laws limit solely automated decisions with significant effects and give people rights to information and review.
- Individual rights: can you find, correct, and delete a person’s data in prompts, logs, and outputs if asked?
- Breach duties: what notice must you give, and how fast, if personal data is exposed?
Business-Confidential Data and Intellectual Property
- Trade secrets can lose protection if they are disclosed without proper confidentiality. Keep them out of tools without the right terms.
- Customer and supplier agreements often restrict sharing their information with third parties, and a vendor’s AI service may count as one.
- Export-controlled technical data may not be shared across borders or with certain people. Ask your compliance lead before it goes near a cloud AI tool.
- Check the rights in AI outputs and the risk that outputs resemble others’ protected material.
- Chat histories and logs may be records, may be requested in legal discovery, and may need to be kept or deleted under policy.
Practical Controls
| Control | What it does |
|---|---|
| Approved tool list and sign-in | Gives people a safe place to work, and lets you apply data terms and logging |
| Enterprise terms: no training, retention settings | Stops your data from being used to train or kept longer than you choose |
| Masking and de-identification | Removes names and identifiers before text goes in; check that it works, because it is easy to miss details |
| Data loss prevention tools | Detect or block sensitive patterns heading to unapproved tools; a net, not a guarantee |
| Access control on logs and outputs | Stops the copies from becoming the leak |
| Training with real examples | People follow rules they understand (see the Workforce Guide) |
| A simple way to ask | “May I use this data in this tool?” answered fast, so people do not guess |
Worked Example: A Data Map at Riverside Plant
Riverside Plant, an illustrative 140-employee metal fabrication and assembly plant, listed its AI uses with the data each touches and decided where each may run. The decisions are illustrative.
| Use | Data touched | Class | Tool | Decision |
|---|---|---|---|---|
| Summarize internal meeting notes | Names of staff; no customer data | Internal | Approved enterprise tool | Allowed |
| Classify customer complaints | Customer name, contact details, product | Confidential; some personal | Vendor service under a data processing contract; no training | Allowed after privacy review; mask names in prompts where possible |
| Search maintenance manuals | Vendor manuals under licence | Confidential | Private deployment | Allowed; check the licence terms |
| Draft replies to a union grievance | Employee personal data, legal matter | Restricted | None approved | Not allowed with AI tools |
| Analyze customer drawings for quoting | Customer designs, may be export-controlled | Restricted | None approved | Not allowed until compliance clears a tool and the contract |
Common Mistakes
A Ban With No Alternative
People use personal tools to get work done.
Trusting a Setting
Believing a privacy setting without reading the terms or testing it.
Forgetting Logs and Outputs
Copies of data sit where access is wide.
Masking Badly
Names removed, but the details still identify the person.
New Purpose, Old Consent
Using data in ways it was not collected for.
No Plan for Deletion
Data cannot be found or removed when asked.
Self-Assessment Questions
- Do we have data classes, and a rule for each class and kind of tool?
- Do we know where each AI use sends data, what the vendor does with it, and how long it is kept?
- Has privacy or legal reviewed uses that touch personal data?
- Can we find and delete data in prompts, outputs, and logs?
- Do people have a fast, approved way to do the work, and know how to ask?
Data Protection and Privacy for AI: Frequently Asked Questions
What data should never go into a public AI tool?
Anything your policy classes as confidential or restricted: personal and health data, credentials, customer and supplier confidential information, trade secrets, legal matters, and export-controlled data. When in doubt, treat it as confidential and ask.
Does an enterprise AI tool keep my data private?
Not automatically. Read the terms: whether the vendor trains on your data, how long it keeps it, where it is processed, who can access it, and how you can delete it. Enterprise terms often differ from consumer terms.
Do privacy laws apply to AI prompts?
If a prompt or output contains personal data, privacy law can apply to it as it does to other processing. The rules vary by place, so ask your privacy or legal lead.
Is masking names enough?
Often not. Other details, such as job title, location, dates, or a unique product, can identify a person or a customer. Check masked text with someone who knows the context, and prefer leaving data out.
How should we handle AI chat logs?
Treat them as records that may hold sensitive data: control access, set a retention period, and know whether legal holds or discovery obligations could apply.
Sources and Further Reading
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5, 22, 28, 33, and 35, on principles, automated decisions, processors, breach notification, and impact assessments.
- California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (check current text and other state laws).
- US Department of Health and Human Services, HIPAA Privacy, Security, and Breach Notification Rules, 45 CFR Parts 160 and 164, on health information (check current rules).
- National Institute of Standards and Technology, NIST Privacy Framework, Version 1.0 (2020), and AI RMF 1.0 (NIST AI 100-1, 2023).
- ISO/IEC 27701:2019, Privacy information management, and ISO/IEC 42001:2023 (check the current editions).