Fazley RabbiTo keep data safe when your team uses AI, decide what may and may not go into AI tools, use business accounts whose data terms you have actually read, give staff a few clear rules, and build automations so they send only the data each task needs. The everyday risk is rarely dramatic hacking. It is ordinary copy and paste: someone pasting a customer list, a supplier contract or a patient's details into a personal AI account to save a few minutes.
Why AI changes the data picture
When someone types or uploads something into an AI tool, that information goes to the provider's servers. Depending on the product, the plan and the settings, the provider may keep it for a period, and some consumer products may use conversations to improve their models unless that option is switched off. Terms differ between products and between personal and business plans, and they change over time.
So the safe approach is not to assume. Read the current terms of the exact plan your team uses, check the settings for history, retention and model training, and make one person responsible for keeping those settings correct.
What counts as sensitive
| Type of data | Examples |
|---|---|
| Customer details | Names with phone numbers, home addresses, national ID numbers, order history |
| Payment information | Card details, bKash or Nagad numbers and transaction IDs alongside names |
| Health information | Prescriptions, test reports, patient records in clinics and pharmacies |
| Staff records | Salaries, CVs, attendance disputes, performance notes |
| Business secrets | Supplier prices, margins, product plans, contracts, bank details |
| Access details | Passwords, API keys, one-time codes, admin logins |
The last row is simple: access details should never go into any AI tool, under any plan.
Seven rules for your team
- Use company accounts, not personal ones. The business should own the AI accounts staff use for work, so it controls settings and can remove access when someone leaves.
- Check the settings. Someone responsible reviews the data, history and training options on every account.
- Remove identities before pasting. Replace names, numbers and addresses with placeholders such as "Customer A" or "Supplier B". The AI rarely needs the real details to help with wording or structure.
- Never paste access details. No passwords, keys or codes, even "just to fix a quick error".
- Ask before uploading whole files. A full customer export or contract should not go into a chat tool without approval.
- Check outputs before they reach customers. AI can mix up details or include information that should not be shared.
- Report mistakes quickly. If something sensitive was pasted by accident, staff should feel able to say so at once, without fear, so it can be dealt with.
These rules work best when they are written down. The article on writing an AI use policy for a small business shows how to turn them into a short policy your team will read.
When you build AI into your systems
Automations and assistants need their own safeguards, because they handle data at volume without anyone watching each request.
- Send only what is needed. If the task is to sort a message by topic, the AI does not need the customer's address or payment history.
- Keep keys on the server. API keys never belong in website code, shared sheets or chat messages. If one leaks, replace it straight away.
- Respect access levels. An internal assistant should not show salary data to someone who could not open the salary file. Permissions should follow the person asking. The company knowledge AI assistant solution covers this point.
- Protect your logs. Logs are vital for checking what happened, but they contain data too. Limit who can see them and how long they are kept.
- Delete what you no longer need, both in your own systems and, where the provider allows, in theirs.
- Review the provider. Read their business terms, find out where data is processed, and keep a record of which tools hold which data.
The legal side
Data protection rules in Bangladesh and in other countries continue to develop, and if you work with foreign buyers or customers, their rules and contract terms may apply to you as well. Do not rely on a blog post, including this one, for legal requirements. Ask a lawyer who knows data protection about your situation, especially if you handle health, financial or children's data.
A short checklist
- We have a list of approved AI tools, and the business owns the accounts.
- Someone has read the data terms and set the options on each one.
- Staff know the six types of sensitive data and what never to paste.
- We remove names and numbers from examples before using them with AI.
- Our automations send only the fields each task needs, and keys stay on the server.
- A person reviews AI output before it reaches customers in sensitive cases, as described in human review in AI workflows.
- We know whom to ask about legal questions.
If you are planning an AI automation and want privacy designed in from the start, see AI and workflow automation.