(08) 8379 4802

What data should my staff NEVER put into AI tools?

What data should my staff NEVER put into AI tools?

Anything covered by the Privacy Act 1988, customer financial details, health information, NDA-covered contracts, and password material — never into PUBLIC AI tools (free ChatGPT, free Gemini, free Claude). Microsoft 365 Copilot in your tenant is different — that’s safe for business data because it stays in your tenant boundary.

The biggest risk in 2026 isn’t the technology — it’s well-meaning staff using personal AI accounts to “save time” without realising the data they’re pasting in might leave the building. A bookkeeper pasting client tax file numbers into ChatGPT to ask “how do I categorise this?” is a data breach in motion.

The framework we recommend:

  • Never in public AI: TFNs, Medicare numbers, health records, full credit card numbers, passwords, signed contracts under NDA, anything you’d shred rather than throw out
  • Caution in tenant Copilot: sensitive HR matters, undisclosed M&A, things subject to legal privilege — Copilot is safe but other staff might still see the chat
  • Generally fine: marketing copy, internal docs, project plans, public information

Step 2 (Foundation) of our AI Readiness Roadmap builds the policy + technical guardrails — Acceptable Use Policy, sensitivity labels, and where appropriate technical controls that block public AI tools at the firewall. So this isn’t a question of staff memory.

Want to talk through this in your specific business context? The first 30 minutes is free — phone or Microsoft Teams. Book a free 30-min scoping call →

All Responsible AI FAQs →

FAQ's

Some of our
Clients