Do not paste company data into an AI tool until you know three things: which plan you are on, whether chats are used for training or reviewed by people, and whether your employer allows it. Samsung banned staff use of generative AI in May 2023 after an apparent accidental leak of source code, according to The Register, though Samsung did not confirm details.
This is a 12-point checklist you can run in ten minutes. It is general guidance, not legal or security advice, so follow your company’s own policy where it exists. Our wider guide to AI tools for beginners covers the basics, and our post on cybersecurity awareness training for employees covers the habits around it.
Step 1: What Kind of Data Are You About to Paste?
| Class (ours) | Examples | Rule of thumb (ours) |
|---|---|---|
| Public | Published web pages, press releases | Fine for any tool |
| Internal | Meeting notes, draft plans | Only on approved tools; remove names |
| Confidential | Customer lists, pricing, source code, contracts | Only on an approved business plan with written permission |
| Regulated | Health, payment or government ID data | Do not paste without legal and security sign-off |
The four classes are our simplification. Your organisation may use different labels, and laws differ by country. If you are unsure which class applies, treat the data as one level higher. For a primer on how these tools work, see what AI tools are.
Step 2: The 12-Point Checklist
| # | Check | Why it matters |
|---|---|---|
| 1 | Is this tool approved by my employer? | Unapproved tools were behind the Samsung ban |
| 2 | Which plan am I on: free, personal paid or business? | Terms differ by plan |
| 3 | Is ‘train on my chats’ on or off? | Controls whether chats feed model training |
| 4 | Do humans review chats? | Google says a subset are reviewed |
| 5 | How long is data kept? | Retention ranges from days to years |
| 6 | Can I delete chats and my account? | OpenAI says account deletion is irreversible |
| 7 | Have I removed names, numbers and IDs? | Less data means less risk |
| 8 | Am I pasting someone else’s data? | Customers and colleagues did not consent |
| 9 | Is the answer going into a public output? | Check for leaked details and facts |
| 10 | Have I verified the facts? | Models can be wrong |
| 11 | Is the tool connected to my email or files? | Connectors widen access |
| 12 | Did I log what I pasted? | Helps if something goes wrong |
What Do the Vendors Say About Training and Review?
| Vendor | Statement (checked 31 October 2026) | Source |
|---|---|---|
| OpenAI | With ‘Improve the model for everyone’ off, new conversations will not be used to train models; Temporary Chats are not used for training and are deleted within 30 days | OpenAI Help Center |
| ‘A subset of chats are reviewed by human reviewers’; do not enter confidential information you would not want a reviewer to see; turn off Keep Activity to stop future chats being reviewed; reviewed chats are retained up to three years | Gemini Apps Privacy Hub | |
| Anthropic | Free, Pro and Max users choose whether chats train models; five-year retention if opted in, 30 days if not; Commercial Terms services not covered by the change | Anthropic, 28 August 2025 |
These are summaries of policy pages that change. Read the current text before relying on it. For a broader look at how AI is used against companies, see how hackers use AI now and AI phishing attacks.
What Should a Simple Team Policy Say?
Keep it to one page: which tools are approved, which data classes may be used, who to ask when unsure and how to report a mistake. Our view is that a short policy people read beats a long one they do not. Governance frameworks are covered in AI governance frameworks, and a good habit for individuals is explained in how to choose the right AI tool.
What If You Already Pasted Something You Should Not Have?
Act quickly and calmly. Delete the chat if the tool allows it, tell your manager or security contact, and note what was shared and when. Deleting a chat may not remove data already used for training, as Anthropic’s update says about data already used in models. Do not hide it, since early reporting lets the company respond.
How Do You Protect Yourself From AI-Related Scams Too?
Data safety has a second side: attackers also use AI. Our guides to verifying deepfake scam calls and spotting phishing texts show how to check a request before acting on it. Treat any urgent request that arrives after you share data with a tool as suspicious until verified.
For small organisations, our small business cybersecurity audit gives a broader checklist, and passkeys vs passwords helps protect the accounts you use for AI tools.
