Using AI at work safely: what not to paste

The five things to keep out

1. Passwords, keys and access codes. Including the ones inside a screenshot or a pasted error message.
2. Other people's personal details. Names with phone numbers, home addresses, health information, ID numbers, salaries.
3. Customer and employee files. A customer list, a payroll export, a CV someone sent you, a complaint with the customer's details.
4. Numbers that aren't public. This quarter's results before they're announced, a price you're about to quote, a deal under negotiation.
5. Anything under an NDA or a client contract that limits who may see it. A contract usually doesn't make an exception for AI tools.

This isn't hypothetical. In 2023 Samsung restricted staff use of generative AI after engineers pasted internal source code into ChatGPT, as Bloomberg reported. Japan's privacy regulator warned companies the same year to check, before entering personal data into an AI service, that it won't be used for anything other than producing the answer.

The settings to check

From OpenAI's and Anthropic's help and privacy pages, read 5 November 2026. Turning training off doesn't make the five things above safe to paste: the text still leaves your company.

A worked example: making a task safe

Illustration: a made-up business. Priya is an office manager at a 20-person physiotherapy clinic. A patient emailed an angry complaint about a billing mistake, and she wants help with a calm reply. The email has the patient's full name, date of birth, phone number, the treatment they had and the amount charged.

Pasting it as is would put health information and personal details into a chat. Instead she pastes this:

The AI never sees who the patient is or what treatment they had, and the reply is just as good. She fills in the three labels herself and sends it. The test she uses: if this chat were shown to the patient, would they mind? Here, no.

Four habits that keep you safe

1. Use the company's AI account for work, if your company has one, and your personal one only for public material.
2. Check the training setting once on any personal account you use for work.
3. Swap before you paste: labels for names, amounts and dates; put the real values back yourself.
4. Read before you send. AI can state wrong facts confidently. Anything going to a customer, a regulator or your boss gets your own read first.

When it's more than you

Rules in one person's head don't protect a company. Once two or three colleagues use AI, write them down in one page: which tools, what never goes in, who checks what goes out. How to get your team to use AI the same way covers the next step, and AI governance for a small company explains what such a page contains.

The AI skill below drafts that one-page set of AI rules for your company from a few questions about your tools and your data, so you start from a draft instead of a blank page.

Questions

Is it safe to put company data into ChatGPT?

Into a company account on ChatGPT Business or Enterprise, within your company's rules, usually yes: OpenAI doesn't train on business data by default. Into a personal account, keep to material you'd be comfortable posting in a public forum, and turn off training in the settings. Even then, a chat you rate with thumbs up or down may be used for training.

Does turning off training make it safe to paste anything?

No. It stops your chats from being used to improve the models, but the text still leaves your company and sits in someone else's service. Contracts, privacy law and your own customers' trust still apply.

Can I paste a customer email if I remove the name?

Usually, if you remove everything that points to the person or company: name, email, phone, address, order number and any detail only they would have. Replace each with a label like [Customer] and put it back yourself afterwards.