Trustworthy AI TestingKit
Sign in

Section 6 · The short rules

Never paste confidential data

The quickest way to turn a productivity tool into a disciplinary matter is to paste something you shouldn't. These rules are deliberately cautious.
  1. RULE 1

    Your employer's policy comes first.

    If your organisation has an AI usage policy or an approved tool list, follow it. If it doesn't, ask before using AI on work material. This kit doesn't override either.

  2. RULE 2

    No personal data.

    Never paste real customer, patient, employee or user data: names, emails, addresses, account numbers, card details, health information or anything else that identifies a person. UK GDPR applies whether or not you meant to share it.

  3. RULE 3

    No secrets.

    No passwords, API keys, tokens, connection strings, private certificates or internal URLs. Strip them out of logs and stack traces before pasting.

  4. RULE 4

    No proprietary code or designs without approval.

    Source code, architecture diagrams, unreleased product details and commercially sensitive documents need explicit permission.

  5. RULE 5

    Sanitise, then paste.

    Replace real values with placeholders (CUSTOMER_A, example.com, 07700 900123). Describe structure rather than pasting content where you can.

  6. RULE 6

    Know your tool's settings.

    Find out whether your AI tool stores conversations or uses them for training, and whether your organisation has a business or enterprise agreement with different terms. Use the approved account, not a personal one, for work.

  7. RULE 7

    If in doubt, leave it out.

    If you'd hesitate to email it to someone outside the company, don't paste it into an AI tool.

  8. RULE 8

    If it goes wrong, report it.

    If you paste something you shouldn't, tell your manager or data protection contact straight away. Early reporting limits the damage; hiding it makes it worse.