Company data is more than a customer spreadsheet
A prompt can reveal a planned launch. A screenshot can show another customer's name. Meeting audio can include a confidential discussion before the official agenda starts. A code sample can contain a password, access token or internal system address.
Look at everything the tool will receive: typed text, attachments, images, audio, chat history and material retrieved through a connection. Also consider what the request reveals. Asking about a named company's acquisition may disclose a plan even if every source article is public.
Use your company's labels
Organisations classify information differently. The following four groups are teaching examples, not a replacement for your employer's definitions. Where labels overlap or are missing, ask the data owner how to handle the material.
| Example group | Fictional example | Working decision |
|---|---|---|
| Public | An approved product page already published on the company website | Use only for a permitted task, with relevant rights and tool approval. |
| Internal | An unpublished team process or meeting agenda | Check which tools and audiences are allowed. Internal does not mean public. |
| Confidential | A client proposal, supplier prices, customer list or unreleased strategy | Use only when the specific task, data and destination are authorised. |
| Restricted | Passwords, access keys, payroll, health information or sensitive personnel records | Stop ordinary AI experimentation and use the specialist approved process. |
Personal information is an additional concern across these groups. A published staff biography and a private payroll record both concern people, but their purposes and handling differ. Do not assume that finding information online permits every reuse.
Outputs need a label too. A summary of confidential source material may remain confidential. Removing the attachment from the final email does not make the summary suitable for a wider audience.
Try sorting a mixed folder
Fictional task: prepare an outline for an internal project review. The folder contains a public brochure, an unpublished delivery plan, a client's negotiated pricing and an API access key copied into a troubleshooting note.
Worked answer: the brochure is public; the delivery plan needs an internal-use check; the pricing is confidential; the access key should not enter the exercise. Ask the relevant owner to confirm the actual labels. For practice, request an empty review outline without any of these files. For real work, use only the authorised sources necessary for the review.
The question is not whether the assistant can read the folder. It is whether each item may be used for this purpose in this destination.
๐ญ What would you do?
Choice 1The deadline and the client proposal
Twenty minutes before a meeting
A colleague asks you to summarise a confidential client proposal. Your personal AI account is open. No approval for this tool or client material has been established.
Checkpoint
List three kinds of information your role handles without including real records. Identify the data owner and the place to check the handling rules.
๐ Quiz
Swipe right if this answers the question correctly, left if it does not.
A file has no confidentiality label. What should you do?
โTreat it as publicโ
Is this the right answer?