Would you paste this?
Ten things from a normal working week. For each one, decide whether you’d paste it into an AI tool at work. Then see our answer, and the two-question test behind it.
Ten cards from a working week
You can also press 1, 2 or 3.
- Does it name or describe a real person?
- Is it confidential to the company or a client?
Fine
After changes
Never
The chips above with a red ring are the ones our list sorted differently. Each card’s reason is in the answer sheet below.
-
Your published price list
Fine to paste. It’s already public, so nothing in it is a secret.
-
A client’s name, address and tax file number
Never. Take the details out and there’s nothing left. A client’s personal details stay out.
-
A draft reply to a client, with their name taken out
Only after changes. The name’s gone, but the job, the address or the dates can still point straight to them. Swap those for roles too.
-
Your login password
Never. Anything that opens a system stays out. If one has ever been pasted somewhere, change it.
-
A spreadsheet formula that isn’t working, with the figures taken out
Fine to paste. With the figures out it’s just a formula, and that’s the kind of help these tools are good at.
-
A contract with another business, under a confidentiality clause
Never. Contracts are commercial-in-confidence. The confidential part is the whole document, so there’s nothing to take out.
-
A screenshot of a customer’s account, to explain a fault
Only after changes. Screenshots carry more than you notice. Crop or blur the customer’s details first.
-
A news article from a public website
Fine to paste. It’s public. Check the summary you get back against the article, though.
-
A customer’s complaint you want help answering
Only after changes. Swap their name and details for roles, like “the customer”, then put them back in yourself.
-
A tender you’re about to submit
Never. Tenders and pricing are commercial-in-confidence. Keep them out.
The test behind every answer.
Two questions sort almost everything. If a thing names a real person, or it’s confidential, it stays out, or the details come out first.
- Does it name or describe a real person?
- Is it confidential to the company or a client?
If the answer to either is yes, leave it out, or take the details out first. Swap names for roles.
For example: “the client”, “Supplier 2”, “the account manager”.
Where your organisation’s own policy says something different, follow your policy.
Where the answers come from
Every verdict follows two documents of ours. One is the data-safety one-pager every workplace session hands out, which lists what stays out and gives the quick test above. The other is our one-page AI policy, whose “what never goes in” clause starts with client names and contact details.
It’s general guidance, and it isn’t legal advice. Where your workplace’s own policy says something different, your policy wins.
More like this on the Keeping data safe shelf.
Want your team sorting its own examples?
Every workplace session has a data-safety part, built around your team’s real work.