The Golden Rule of AI Privacy
Private AI vs. Non-Private AI: know which one you are using before you share.
Never enter confidential, client, personal or private business information into Non-Private AI.
Before sharing information with an AI tool, you need to know which type of AI you are using.
Approved for work use
AI with suitable privacy protections, approved by your organisation for work use.
Examples may include:
- Company-provided AI business or enterprise accounts, such as ChatGPT Business or Microsoft 365 Copilot.
- Secure AI systems hosted within your organisation.
- Properly secured local AI models running on your own equipment.
You CAN use Private AI for:
- Public information.
- Internal business information.
- Confidential or client information, where your organisation has approved that use.
Important: Private AI does not mean that every type of sensitive information is automatically permitted. Follow your organisation's rules.
Not approved for private information
AI that has not been approved for handling your organisation's private information.
Examples include:
- Personal AI accounts, including paid personal subscriptions, unless specifically approved.
- Unapproved AI websites, browser extensions and apps.
- New AI tools whose privacy protections have not been checked.
You CAN use Non-Private AI for:
- Public, non-sensitive information.
- Published articles and marketing material.
- Completely fictional examples and test data.
You MUST NOT enter:
- Confidential client information.
- Non-public personal information.
- Internal business documents.
- Financial records or proprietary business information.
Who is responsible?
- Check the privacy and security protections of AI tools.
- Decide which AI systems are approved.
- Decide what types of information can be used with them.
- Make the rules clear to staff.
Who is responsible?
- Use the correct approved AI account or workspace.
- Follow the rules for the information you are handling.
- Never enter private information into an unapproved tool.
Before entering work information into AI, ask: 1. Is this an approved Private AI system? 2. Am I allowed to use this information here? If the answer to either question is NO, or you are unsure, do not enter the information.
If you don't know whether an AI tool is Private, treat it as Non-Private until you have checked.
We're classifying the AI account or environment you're using, not the AI brand itself. The same AI provider may offer both Private and Non-Private environments.
The Golden Rule: Know which one you're using before you share.
When to use Before sharing work information with any AI tool.
Read the full post →