Before pasting customer data into an AI tool, ask one boring question: are we actually allowed to do this?

Before using the data

• Do we need this information for the task?
• Are we authorized to share it with this provider?
• Does the tool retain or train on the data?
• Is there an enterprise/business setting with stronger controls?
• Could we remove names or sensitive fields first?
• Do we have contractual or regulatory obligations that apply?

Use the minimum data necessary

If the job is to summarize a service complaint, the model probably does not need a full customer record, payment history and home address.

Give staff a simple rule

“Do not paste sensitive customer, employee or financial information into unapproved AI tools” is more useful than a policy nobody remembers.

This is not legal advice

Privacy requirements vary by industry, data type and jurisdiction. When the stakes are high, get appropriate legal or security guidance.