How Do I Stop Staff Pasting Confidential Data Into AI Tools?

Give staff an approved tool that is good enough to use, a plain rule about what never goes in, and a simple way to ask when unsure. Bans alone push the behaviour out of sight.

Why staff do it

Mostly convenience. They are trying to finish work faster and have not thought about where the text goes. A few do it because the approved route is slow or does not exist.

Steps that work

1. Provide a sanctioned tool. A business plan of ChatGPT, Claude, Copilot or Gemini with training opt-out and admin controls gives people a safe place to go. Check current data terms for your plan, for example OpenAI's enterprise privacy page.
2. Write the rule in plain words. List what never goes in: client names with details, health or financial records, passwords, contract terms under confidentiality.
3. Show safe alternatives. Mask names and numbers, use placeholders, or describe the problem generally.
4. Make asking easy. Name one person for borderline cases and answer quickly.
5. Use technical controls where available. Admin settings, single sign-on, restricting personal accounts, and data loss prevention features in your existing email and document platforms.
6. Check in. Ask what people actually use AI for, without blame, and adjust.

Culture matters

If staff fear punishment they will hide use, a form of shadow AI. Tell them that a quick report of a mistake is welcome, and fix the process when slips happen.

Records and law

Where personal information is involved, privacy obligations may apply, as the OAIC's guidance on commercially available AI products explains. Speak to a lawyer about your own position.

21Labs sets up the tools, the rules and the habits together as part of AI adoption.