Data security and privacy: what you can share¶

Level: Beginner

This tip explains what you can hand over to an AI assistant, and how to do it safely. It is the foundation for every other tip, which all assume you keep these habits.

What happens when you send a text¶

A text pasted into an assistant leaves your computer. What happens to it depends on the tool and the plan in use: it may be stored, reviewed for control purposes, or, with some consumer plans, used to improve the service. A business plan configured by the company usually offers better guarantees, but they only apply within the intended scope.

The right reflex is therefore to assume that anything you send may one day be read by someone else. This does not mean giving up on AI, but choosing what you send.

Three kinds of sensitive data¶

• Personal data: name, address, email, phone number, ID, photo of a customer, a colleague or a candidate. Health or trade-union data are even more protected.
• Strategic data: unannounced projects, negotiated prices, margins, contracts, site plans, vulnerabilities, information about our customers' security.
• Data entrusted by a third party: anything a customer or partner gave us under a confidentiality agreement.

Anonymizing without losing the meaning¶

Anonymizing means replacing what identifies someone or something with a neutral element, while keeping what the AI needs to help you.

Three precautions make the method more reliable:

1. Keep the logic. Use "Customer A" and "Customer B" rather than erasing everything: the AI then understands who does what.
2. Keep the mapping separately. A small table ("Customer A = …") in a local file lets you put the real names back afterwards.
3. Check the context. A text without names can still be identifiable: "the only customer in the region ordering more than €200,000" points to someone. The rarer a detail, the more you need to generalize it.

Leaks you don't think about¶

• Attachments: a document often contains names in the header, comments, properties or file names.
• Screenshots: they sometimes show a tab, a signature or a contact list in the background.
• Whole email threads: the message you want translated is followed by ten earlier exchanges, with their recipients.
• Passwords, access keys and private links: they never belong in a conversation with an AI.

Five questions before you send¶

1. Does this text contain a person's name or identifier?
2. Does it contain a figure or information that is not public?
3. Could someone guess who or which customer it is about?
4. Is the tool I am using the one the company provides for this type of content?
5. Would I be comfortable if the person concerned read this text?

A single answer that makes you hesitate is enough reason to anonymize, or to ask your manager.

When it is better not to use AI¶

Some content must not be sent, even anonymized: classified documents, health data, information under a strong confidentiality obligation, or any case the charter excludes. In those situations, the right decision is not to use the tool.

Hands-on exercise (5 minutes)¶

1. Take a real text from your work.
2. Anonymize it: names, figures, places, exact dates.
3. Read it again as a stranger would: can you guess who it is about?
4. Check that it is still useful for the intended task.

For definitions, see the glossary and the FAQ.