What Not to Share With AI: Practical Examples
Keep passwords, identity documents and unnecessary personal or confidential details out of AI prompts. Use fictional examples and minimise data.
BMR Digital · Source review 2026-11-06 · UK English
Start with what the task really needs
Before you ask an AI assistant to help, separate the problem from the personal details surrounding it. A request for a polite complaint letter rarely needs an unedited bank statement. A question about organising appointments rarely needs a full customer list. Write the task in one sentence, then decide which facts are essential to answer it. You can often use approximate dates, fictional names and a simplified example. This is not about making every prompt vague; it is about retaining useful context without handing over unrelated information. Check your account type and the provider’s current data terms as well. A privacy setting can affect certain uses of data, but it does not make every upload appropriate. If you are handling information on behalf of someone else, their trust and your obligations matter even when the service is convenient or well known.
Passwords and access credentials do not belong in prompts
Do not paste passwords, one-time login codes, recovery codes, API secrets, private keys or full authentication links into a chatbot. These values can grant access to accounts or services. If you need help with a technical error, replace the secret with a clear placeholder and include only the non-sensitive part of the message. Check screenshots carefully: a terminal, browser address bar or password manager window may show a credential alongside the issue you want to explain. If a secret has already been shared, changing a training preference is not the appropriate remedy. Revoke or rotate the exposed credential and review relevant access records. Avoid asking the assistant to store a password for later convenience. Use a reputable password manager and the account’s supported authentication options instead. The best redaction is the one that prevents the secret leaving your control in the first place.
Identity, financial and health documents deserve extra care
Passports, driving licences, bank statements and health letters can contain several identifying details in one file. Even if your question concerns only one paragraph, the uploaded document may reveal everything on the page. Consider whether you can type a short non-identifying extract instead. Do not upload documents belonging to children or another adult merely because you have access to the file. For financial questions, remove account numbers and detailed transaction histories unless an appropriately approved service genuinely requires them. For health questions, remember that a chatbot is not a confidential clinical relationship or an emergency service. Seek qualified advice for decisions affecting treatment. If a regulated professional has provided a secure system for sharing documents, use that process rather than improvising with an unrelated AI tool. Convenience does not establish that a service is suitable for highly sensitive records.
Customer details and workplace information are not personal choices
An employee may be comfortable using AI personally but still lack authority to upload a customer’s information. Examples include invoices with addresses, complaint threads, booking lists, vehicle registration details and staff records. A customer has not necessarily agreed to a new use of their information just because they emailed the business. Follow your organisation’s approved process and current data-protection obligations. If no process exists, ask before sharing. Draft a response using a neutral scenario, then insert the real details in the business system afterwards. Confidentiality also extends beyond personal data: supplier prices, negotiations, unpublished plans and contracts can be commercially sensitive even without names. Removing an email address does not remove the confidential substance of a deal. Make the allowed task clear enough that staff do not have to guess where the boundary lies.
Anonymisation is harder than replacing a name
A record may still identify someone through a combination of location, dates, unusual circumstances and job title. Replacing “Jane” with “Customer A” is pseudonymisation if the remaining context or a separate key can identify her. That can still be personal data. For an AI drafting task, try a genuinely fictional example rather than a lightly edited real record. Change unnecessary circumstances and remove unique details. If accurate individual information is essential, you need a suitable authorised process instead of pretending that one changed name solves the problem. Do not make a false claim that a file is anonymous without assessing it. Be especially careful with small communities or unusual incidents where a handful of facts can point to one person. The aim is to preserve only the information needed for the task, not to create a puzzle that remains easy to solve.
Check attachments, images and hidden context
Uploads can reveal more than the visible paragraph. A screenshot may include notifications, account names, browser tabs or another customer’s message. A spreadsheet can have extra sheets, comments and rows below the section you intended to use. A document may contain revision history or identifying headers. Review the complete item before sending it. For routine help, create a new clean example rather than editing a sensitive original in place. Avoid connected-drive access when a single non-sensitive extract would be sufficient. Check who owns the file and whether you have permission to share it. Do not assume that cropping an image removes all contextual information or that a provider ignores background content. A small amount of preparation can prevent a much larger disclosure than the task requires, while still allowing the assistant to help with wording, structure or a general explanation.
Build a pause into everyday use
Use three questions: do I have authority to share this, does the task need it, and is this account suitable? If any answer is uncertain, stop and use a fictional example or an approved route. Keep a short list of prohibited information near the device you use for work. Review connected services periodically and revoke access that is no longer needed. If private material was shared accidentally, report it promptly through the appropriate process and avoid repeating it in multiple messages while explaining the incident. The Personal Data in AI guide provides a printable audit approach; the workplace guide focuses on staff rules and organisational response. The free checklist is a useful reminder rather than permission to upload sensitive content. Better privacy comes from repeatable decisions about information, not from expecting a single toggle to make every possible task safe.
Official sources and further checks
Provider settings can change and differ by account, plan and location. Check the current official instructions for the service you actually use. This is independent educational guidance, not a safety or legal compliance guarantee.
A printable next step
Compare Protect Your Personal Data in AI for the stated printable guidance, or start with the free checklist. Only genuine uploaded files are offered for download.
View Protect Your Personal Data in AIUseful AI safety reading
All resourcesChatGPT Privacy Settings: What Each Control Does
Training, history, memory and connected apps are separate ChatGPT controls. Review each one before sharing personal or customer information.
AI Safety for Children: A Parent's Starting Guide
Begin with age rules, private information, supervised chatbot use and calm family conversations about deepfakes and misleading answers.
AI Policy for Small Business: Simple UK Starter Guide
Set approved tools, prohibited data, human checks and incident reporting before staff use generative AI for customer work.
AI Voice-Cloning Scams: How to Check a Fake Call
Do not rely on a familiar voice alone. End the call and independently contact the person or business through a known route.
What Not to Share With AI: Practical Examples
Keep passwords, identity documents and unnecessary personal or confidential details out of AI prompts. Use fictional examples and minimise data.
Gemini Activity & Privacy Settings Explained
Review Gemini Keep Activity, deletion, connected services and account type separately; switching off activity does not mean no processing or retention.
Claude & Copilot Privacy Controls Compared
Compare account type, training preferences, history, memory and connections rather than assuming Claude or Copilot is completely private.