What data should you never give an AI chatbot?
A simple red, amber and green rule for staff, plus the UK data protection points to remember.
Many AI incidents in small organisations are not clever attacks. Someone simply pastes the wrong thing into the wrong tool. A short, clear rule about what is allowed prevents most of them.
Green: fine in approved tools
- Public information, such as what is already on your website
- Drafts of marketing copy
- General questions that contain no personal or confidential details
Amber: approved business tools only
- Internal documents and plans that are not public
- Customer data that has been anonymised
- Anything where you have checked the supplier’s terms on how data is used and kept
Red: never in public AI tools
- Personal data about customers or staff
- Passwords, API keys and other secrets
- Contracts and documents under a confidentiality agreement
- Health and financial records
Why it matters under UK data protection law
If an AI tool handles personal data, UK GDPR applies as it does to any other system. You need to know why you are processing the data, have a suitable contract with the supplier, check where the data goes and keep only what you need. For higher-risk uses, a data protection impact assessment is expected. This is general information, not legal advice.
Make it stick
Put the three colours on one page, share it with the team, and keep a list of approved tools. Our free guide includes a ready-to-adapt staff policy, and our AI security check shows where your organisation stands today.