# Data Safety

Course: [Prompting at Work](https://www.devtutorials.ai/learn/prompting-at-work) · Section: Going Further
Source: https://www.devtutorials.ai/learn/prompting-at-work/going-further/data-safety

> Keep confidential data out of AI chats. Sort information into green, amber and red, anonymise customer and employee details, describe data instead of pasting it, and let the AI leave placeholders.

## What Is in This Email?

Dev works in HR and has been asked to help with a customer complaint. He copies an entire email into an AI chat tool and prepares to ask for a reply.

Look at the red warning strip under the message box. Then press Send.

The detector found:

- A customer's name
- An email address
- A phone number
- A full card number

In this lesson, Send remains blocked while sensitive information is present.

Now notice what happens when the personal details are removed and only the situation remains. The AI still produces a useful reply because it never needed those details in the first place.

**In simple words:** Give the AI the problem, not the person.

## TL;DR

- Anything you paste into an AI tool leaves your hands.
- Use only AI tools approved by your company.
- Never paste personal data, payment information, passwords, or health information into an unapproved AI tool.
- Sort information into three groups: Green, Amber, and Red.
- Anonymise information by replacing names and identifying details with placeholders.
- Describe data instead of pasting it.
- Let the AI leave placeholders, then fill in the real details yourself outside the AI tool.

## A Real-World Example

Imagine asking a temporary worker to help draft a reply to a customer complaint.

Would you hand them the customer's card number, home address, and phone number? Probably not.

You would simply say:

*"A customer was charged twice and wants a refund. Please draft a polite reply."*

Then you would add the customer's details yourself before sending it. AI should be treated the same way. Give it what it needs to solve the problem, and nothing more.

## What You Will Learn

In this lesson, you will learn:

1. Why sharing data with AI can create risks.
2. How to sort information into Green, Amber, and Red categories.
3. How to anonymise information.
4. How to describe data instead of sharing it.
5. How to use placeholders safely.

## Why It Matters

### Where Your Information Goes

When you send a message to an online AI tool, the information leaves your device and is sent to the company providing the service.

Depending on:

- The tool
- Your subscription plan
- Your company's settings

the information may be stored, logged, reviewed, or processed externally.

Personal AI accounts are often less protected than company-approved versions. That is why many organizations maintain a list of approved AI tools.

The AI used inside these lessons runs locally in your browser. Work AI tools usually run on the provider's systems.

### What Can Go Wrong?

Sharing the wrong information can result in:

- Personal customer information leaving company systems
- Card or bank details being exposed
- Violations of privacy or data-protection rules
- Confidential employee health information being shared
- Damage to customer trust

The AI is often not the problem. The problem is sharing data that should never have been pasted into the tool.

## Green, Amber and Red

### The AI Policy

### Sort It

Sort each example into Green, Amber, or Red.

**Easy way to remember:** If you would not put it on a poster in the office kitchen, it probably is not Green.

### What the Colours Mean

| Colour | Meaning |
|----------|----------|
| Green | Safe to use in approved AI tools |
| Amber | Use only in approved company tools and follow company rules |
| Red | Never paste into an AI tool unless your company explicitly permits it |

## Anonymise It

### Keep the Problem, Remove the Person

To **anonymise** something means removing details that identify a real person while keeping the information needed to solve the problem.

Replace identifying details with placeholders, for example:

- John Smith → [customer name]
- INV-4821 → [invoice number]
- jane.smith@company.com → delete it
- 555-123-4567 → delete it

Keep the actual business problem:

- Charged twice
- Item arrived damaged
- Invoice is overdue
- Delivery arrived late

### Try It

Here is the same customer email.

Replace every personal detail with a placeholder or remove it completely.

Send becomes available when all sensitive information has been removed.

The AI can still create a useful reply. You add the real customer details later in your normal email system.

## Describe, Don't Paste

### Describe the Data

Often you do not need to share the data itself. You only need to describe it.

For example, to get help with a spreadsheet formula, describe the columns instead of sharing the spreadsheet.

The salary data never leaves the spreadsheet. The AI provides the formula, and Lakshmi uses it inside Excel.

### Describe the Situation

The same principle applies to people. Describe the situation rather than the individual.

Dev almost wrote:

*"Meera in the warehouse is returning after six weeks away because of a back injury."*

Instead, he asked about:

*"An employee returning after a long absence."*

The checklist works just as well, and no private information is shared.

## Let the AI Leave the Gaps

Sometimes a document genuinely needs private information, such as bank details. In those situations, tell the AI to leave placeholders instead.

Examples:

- [bank details]
- [customer name]
- [account number]
- [reference number]

Then add the real information yourself later.

The real account number is added later inside Lakshmi's email system, so it never passes through the AI tool.

Never use AI to review, clean up, or validate real passwords, card numbers, or bank account details unless your company's policy explicitly allows it.

## Common mistakes

| Mistake | What Happens | How to Fix It |
|---|---|---|
| Pasting an entire customer email | Personal data leaves company systems | Remove names and contact information |
| Using personal AI accounts for company work | Company information leaves company control | Use approved company tools |
| Sharing spreadsheets to get formulas | Real data is unnecessarily shared | Describe the columns instead |
| Including employee names in HR questions | Private information is exposed | Describe the situation only |
| Letting AI create account details | Incorrect or sensitive information appears in drafts | Use placeholders instead |

## Exercise

Complete each task below and then press Check. In these activities, Send stays locked while sensitive information remains in your prompt.

## What to Remember

- Anything you paste leaves your hands.
- Use only approved AI tools.
- Sort information into Green, Amber, and Red categories.
- Keep the problem and remove the person.
- Use placeholders instead of personal information.
- Describe data instead of sharing it.
- Add private details yourself after the AI has finished.

### Key Takeaway

**The best AI prompt contains only the information needed to solve the problem.**

Before you paste anything into an AI tool, ask yourself:

*"Does the AI really need this information?"*

If the answer is no, remove it.

Next: Role Playbooks