Do not share information simply because AI can process it.
A useful AI prompt does not need every detail you know. In many situations, the safest and most effective approach is to provide only the minimum information required for the task.
This is especially important when working with information that belongs to customers, employees, suppliers, employers or other people.
If a piece of information is not necessary for the AI task, leave it out.
Some information deserves extra protection.
Passwords & authentication details
Do not paste passwords, one-time codes, API keys, recovery codes, private tokens or login credentials into an AI tool.
Financial information
Avoid sharing bank account numbers, card details, payment credentials, confidential pricing information or sensitive financial records unless you are using an approved system specifically designed for that data.
Personal identity information
Be careful with passport numbers, national identification numbers, employee IDs, private addresses, personal phone numbers and other data that could identify someone.
Confidential workplace information
Internal reports, customer records, contracts, pricing, unreleased plans, operational incidents and company documents may be confidential even when they do not look highly sensitive.
Customer & employee data
Names, contact details, performance records, payroll information, complaints, HR information and customer histories may be protected by company policy or privacy requirements.
Restricted technical information
Source code, security configurations, internal architecture, proprietary formulas, private credentials and vulnerability information should only be shared through approved systems and processes.
Something does not have to be secret to be sensitive. A normal workplace document may still contain personal, commercial or operational information that should not be entered into an unapproved AI system.
Ask six questions before putting real information into AI.
Do I have the right to share this information?
Does AI actually need this detail to complete the task?
Could this information harm someone or the organisation if exposed?
Does my organisation allow this information to be used with this AI tool?
Can I remove names, numbers or confidential details first?
Can I describe the situation without sharing the original data?
If you would hesitate to send the information to an unknown external person, do not automatically paste it into an AI tool.
Most AI tasks can be completed with less sensitive information.
Redaction and anonymisation can often preserve the useful context while removing information that AI does not need.
Customer: Mohamed Ali
Customer A
Account 4892-7721-1184
Customer account
Supplier rate: QAR 7.85 per unit
Current supplier rate
Actual payroll figures
Example figures for demonstration
Full confidential incident report
A summary of the relevant non-sensitive facts
Complete customer database
Only the non-identifying fields required for the task
Reduce the prompt to the smallest amount of real information necessary to achieve the result.
Not every AI input carries the same level of risk.
Public or generic information
Public product descriptions, generic examples, common knowledge and fictional practice data are normally easier to use safely.
Internal operational information
Internal processes, non-public reports and workplace details may require approval, redaction or use of an organisation-approved AI system.
Personal, confidential or security-sensitive data
Credentials, personal records, financial details, restricted business information and security data should not be entered into unapproved AI services.
Higher-risk information deserves stronger controls. This may mean not using AI at all, using only an organisation-approved AI environment, or removing sensitive details before processing.
You need AI to help write an inventory investigation summary.
A warehouse team identifies a stock difference. The internal investigation file contains employee names, customer details, document numbers and other operational information.
Paste the complete investigation file.
This may expose personal and internal operational information that AI does not need in order to help structure the report.
Extract only the necessary facts.
Provide the verified system quantity, physical quantity, variance, checks already performed and investigation status without including unnecessary identifying details.
- System quantity: 1,780 units
- Verified physical quantity: 1,753 units
- Variance: 27 units shortage
- Receiving records reviewed
- Outbound transactions reviewed
- Adjustment history reviewed
- Root cause not yet confirmed
Write a complaint response to customer John Perera, passport number N1234567, phone +974 XXXXXXXX, regarding account 984277 and the payment dispute described in the attached internal customer file.
Write a professional response to a customer regarding a disputed payment. The customer says the amount charged does not match the agreed amount. Acknowledge the concern, explain that the transaction is being reviewed, and ask the customer to wait for confirmation. Do not invent the investigation result.
Build privacy checks into the workflow before AI is used.
Identify the information
Before pasting anything, recognise whether the material contains personal, confidential, restricted or commercially sensitive information.
Remove unnecessary details
Keep only the information AI genuinely needs to perform the task.
Replace identifying information
Use labels, placeholders or fictional examples where the real identity is not necessary.
Confirm the tool is approved
Follow your organisation's rules about which AI systems may be used for workplace information.
Inspect before submitting
Read the final prompt once more and remove anything that should not leave the approved environment.
If your employer has an AI policy, data-handling policy or list of approved tools, follow that policy before using workplace information with AI.
Useful prompts do not require unnecessary exposure.
Responsible AI use begins before the prompt is submitted. Identify sensitive information, remove what is unnecessary, anonymise what can be anonymised and use approved systems for information that requires stronger protection.
Recognise sensitive data.
Remove unnecessary details.
Confirm the tool is appropriate.
Submit only what is needed.
Describe the task without exposing unnecessary data.
Use placeholders, anonymised facts and clear constraints when building prompts for workplace tasks.