8.1 Privacy and Sensitive Information

Using AI well means more than writing prompts. It also means knowing what not to enter casually. Treat the chat box like an external worktable. Before pasting text or uploading a file or image, ask: “Whose information is this? Is it truly needed for the task? Am I allowed to place it here?”

Sensitive information can include names, phone numbers, identity numbers, addresses, and health records that identify a person. It can also include unpublished contracts, customer lists, financial data, product plans, passwords, verification codes, and access keys. Rules vary by organization, school, and region, so follow your organization's policy and the product's current data information.

Use the minimum necessary information

Even when material is approved for use, provide only what the task needs. To rewrite a complaint response, the issue type may matter, while the customer's name, phone number, and full order number usually do not. Replace real identifiers with placeholders such as “Customer A” or “order number removed.” This is called redaction.

Redaction is more than covering visible words. Check hidden spreadsheet columns, image backgrounds, document comments, and combinations of details that could still identify someone. The safest input is one that never contains unnecessary information. Passwords, verification codes, and access keys should not be given to chat products.