Remove confidential and identifying information before prompting, use approved tools and keep sensitive source material outside the AI workflow.
Use care25 minute route
I need to protect data when using AI
Reduce privacy exposure by deciding whether AI is appropriate, minimizing the input and using approved tools and retention settings.
Quick answer
The safest way to start
Remove confidential and identifying information before prompting, use approved tools and keep sensitive source material outside the AI workflow.
Replace names, addresses, account numbers and internal project labels with neutral tokens when they are not essential to the task.
Do not paste passwords, customer records, private contracts, medical details or proprietary source files into an unapproved service.
Stop when policy is unclear or the data includes passwords, recovery keys, regulated records, private customer data, confidential legal material or information you are not authorized to share.
Only necessary, authorized information is included.
1 · Triage
Quick checks before changing anything
Use these checks to narrow the problem and avoid applying an unrelated fix.
Classify the information
Identify credentials, personal data, customer records, health details, contracts, unpublished work and organization-confidential information.
Check policy and ownership
Confirm whether your employer, client, school or data subject permits the information to be processed by the chosen service.
Review tool settings and terms
Check account type, training controls, retention, sharing, connector access and administrator policy rather than assuming all AI chats are private.
2 · Stabilize
Safe first actions
Mark actions as you complete them. Progress is stored only in this browser.
3 · Diagnose and resolve
Step-by-step route
Continue only when the result of the current step supports the next one.
- 1
Decide whether AI is necessary
Compare the benefit with the sensitivity and whether a non-AI tool can complete the task.
Expected resultHigh-risk data is not exposed for a trivial convenience. - 2
Minimize and redact
Create a sanitized copy and review it manually for hidden metadata and contextual identifiers.
Expected resultThe input contains only what the model needs. - 3
Control output and sharing
Review generated text for leaked source details, inferred personal information and unsafe recommendations.
Expected resultThe output is safe before it is copied into another system. - 4
Document the workflow
Record tool, purpose, data category, approval and deletion or retention steps.
Expected resultThe use can be audited and repeated responsibly.
Stop and escalate when
- Stop when policy is unclear or the data includes passwords, recovery keys, regulated records, private customer data, confidential legal material or information you are not authorized to share.
4 · Verify
How to know the problem is resolved
- Only necessary, authorized information is included.
- The tool and account settings meet the applicable policy.
- The generated output has been reviewed for disclosure before use.
5 · Build the skill
Recommended learning route
Open these lessons in order when you need more detail or want to prevent the issue from returning.
Protect sensitive data
Remove private, client, financial and authentication details unless approved.
AI & Productivity · Privacy and Responsible UseKnow what not to automate
Keep human approval for sensitive, irreversible or high-stakes actions.
AI & Productivity · Analysis and Repetitive WorkKeep human sign-off
Make the responsible person review and own the final decision.
AI & Productivity · Privacy and Responsible UseReview app permissions
Limit camera, microphone, location and file access to apps that need it.
Online Security · Privacy and Safer Browsing6 · Practice and reference
TipsMake tools and guides
Related routes
Continue with a connected problem
Common questions
FAQ
Is removing a person’s name enough to anonymize data?
Often no. Dates, locations, job titles, rare events and combinations of attributes can re-identify a person. Remove unnecessary context and assess re-identification risk.
Can I paste API keys or passwords into AI to debug them?
No. Revoke exposed secrets and use redacted examples. Credentials should be stored in secret-management tools, not conversational prompts.