Generative AI can help draft emails, summarise information and organise routine work. But pasting a customer complaint, employee record or confidential attachment into a tool can create a new use of personal data. The same care applies whether the upload is deliberate or accidental.
The safest starting point is a clear workplace policy: which tools are approved, what staff may use them for and what information must stay out.
1. Use approved tools, not personal accounts
Ask your organisation which AI services and account settings have been assessed. A tool's popularity or a paid subscription is not, on its own, evidence that a particular use is appropriate. Check who can access prompts and outputs, how long they are retained, whether they may be used for training, and how deletion requests are handled. Where a provider processes personal data on your behalf, assess the relevant contractual arrangements.
2. Start with the purpose and the minimum data
Before uploading anything, ask whether the task needs personal data at all. To draft a generic reminder email, fictional details may be enough. To summarise an actual customer dispute, your organisation should assess the lawful basis and relevant safeguards rather than letting individual staff decide informally.
Removing names is not always anonymisation. A postcode, unusual job title, dates or a detailed account of an incident may still identify someone when combined. Use genuinely fictional examples where possible, and do not upload an entire customer file when a non-identifying description would do.
3. Apply extra care to sensitive information
Health information and other special-category personal data need additional consideration. Keep these records out of unapproved tools. Ask the person responsible for privacy to assess proposed uses, including whether a data protection impact assessment is required. Not every AI task needs a DPIA; processing likely to result in a high risk does.
4. Check the output before acting
AI-generated text may be inaccurate, incomplete or misleading. Have a competent person review material before sending it to a customer, adding it to a record or using it to support a decision. Do not turn a drafting tool into an unassessed process for decisions that significantly affect people.
5. Give staff a clear route for mistakes
If somebody uploads confidential information to the wrong tool, encourage prompt internal reporting. Record what was shared, where and when, then follow the organisation's incident procedure. Do not assume deleting a chat immediately removes every provider-held copy. Whether regulatory notification is required depends on the incident and its risk, not simply on the fact that AI was involved.
A short team checklist
- Is the tool and account approved for this task?
- Can the job be done without personal data?
- Have provider handling and relevant privacy requirements been assessed?
- Will a person check the output?
- Does everyone know how to report an accidental disclosure?
Digital care should sit alongside physical records security. Keep confidential printouts secure and dispose of them through an appropriate process when their retention period ends. See our secure shredding services or ask about a collection.
Sources and further reading
Published 3 November 2026. General information, not legal advice. ICO AI guidance is under review following the Data (Use and Access) Act 2025; check the latest guidance before making compliance decisions. Cover image is AI-generated and illustrative.