Many organisations have an approved AI tool and a policy for what can go into it. Where one exists, it overrides anything in this guide. If none exists, ask, and treat the list below as the minimum.
Depending on the tool, your plan and its settings, what you type may be stored, reviewed by the provider or used to improve future models. Business and enterprise plans often give stronger protections than free personal accounts, but you should only rely on that when your company has confirmed it. Until then, assume anything you paste could be seen by someone outside your organisation.
Keep these out
- Personal details of real people. Names linked to anything sensitive, phone numbers, home addresses, ID numbers such as Aadhaar or PAN, dates of birth.
- Pay and money about individuals. Salaries, bonuses, bank details, loans and deductions.
- Health and personal circumstances. Medical information, disabilities, leave reasons, family situations.
- Performance and disciplinary records that identify a person: reviews, warnings, investigations, exit interview notes.
- Customer data. Contact lists, account details, order histories, support tickets with names.
- Confidential business information. Unannounced results, deal terms, pricing strategy, legal matters, source code, passwords and access keys.
In India, the Digital Personal Data Protection Act, 2023 (DPDP) sets rules for how organisations process personal data. Sharing an employee's or customer's personal data with an outside tool, without a proper basis, can be a compliance problem as well as a trust problem.
The two-minute redaction habit
You can still get help with most sensitive tasks. Strip the parts that identify people or the business before you paste:
- Swap names for roles. "Priya Sharma" becomes "Employee A"; "Acme Corp" becomes "Client 1".
- Round or band numbers. "₹14,85,000" becomes "about ₹15 lakh", or "mid-band for the role".
- Remove dates and locations that would make a person easy to identify.
- Describe instead of pasting. Instead of pasting a full investigation note, describe the pattern: "an employee has been late to client meetings four times this quarter".
- Put the details back yourself after the AI has done the drafting.
Tasks that are usually safe
Plenty of valuable work involves no sensitive data at all:
- Drafting templates: job descriptions, policies, onboarding plans, email formats
- Explaining concepts, regulations or frameworks in plain language
- Brainstorming questions, agendas, training ideas and survey items
- Rewriting your own text for tone, length or clarity
- Working with data that is already public or fully anonymised
Some decisions should stay with people
Even with clean data, don't let a chatbot make decisions about people on its own: who to reject, who to promote, who to let go. AI can help you structure the decision, draft the communication and check your reasoning for bias. The decision, and the accountability for it, stays with a person.
Go deeper on AI governance
Module 10 of AI for HR Professionals covers DPDP in practice, bias auditing and building an AI policy your team can adopt.
This guide is general information, not legal advice. For decisions about your organisation's obligations, speak to your legal or data protection team.