AI Privacy Checklist: What Should You Share With AI?

Suppose you want help writing a polite appointment reminder. The customer's full name, home address and account history may add nothing to the writing exercise. “Customer A, appointment Tuesday at 2” may be enough for a fictional draft.

For a household planning example, use “an evening commitment” instead of a family member's name and private reason. For a practice budget layout, use made-up numbers. You can add the real details yourself later, outside the AI tool.

Removing a name alone does not necessarily make a record anonymous. A combination of an unusual event, exact date, location and job title may still identify someone. Reduce the whole context, not just the obvious label.

Do not put passwords, recovery codes, secret API keys, full payment-card information or identity-document images into practice prompts. A chatbot does not need your password to explain how a process works.

Treat requests to paste credentials as a reason to stop and verify the legitimate setup route. Use the service's supported sign-in or secure authorization process when an approved task actually requires access. Do not send credentials to a person or address merely because an AI response suggests it.

Read the current privacy and data-use information for the exact product and account type you use. Useful questions include: what is retained, who can access it, whether content may be used to improve models, how sharing works and what deletion means. Settings and terms can differ between personal and workplace products.

Do not assume a paid plan makes every use appropriate. Equally, do not assume a setting available in one product exists in another. If you cannot establish how a sensitive record will be handled, leave it out while you investigate.

For work, follow your organisation's approved-tool and information-handling rules. Canada's privacy regulator highlights authority for personal-information use, transparency and limiting unnecessary sharing when businesses use generative AI. A convenient drafting task does not remove those responsibilities.

Connecting an app may allow more than reading the one item you had in mind. Review the requested permissions and their scope before accepting them. Ask whether a copy of a non-sensitive excerpt would achieve the same result without ongoing access.

A simple boundary might be: read this approved document, produce a summary and stop. Sending a message, editing a record or buying something is a separate action. State those limits explicitly, then check the tool's actual capabilities rather than assuming a prompt alone enforces them.

The address, medical context and access code are not needed to learn the drafting pattern. The revised note still contains the information that affects the example. Never reuse the illustrative code as a real one.

AI-generated summaries may repeat information you meant to keep private or infer details you never supplied. Read the final output and the recipient list before copying, publishing or sending it.

If you accidentally share sensitive information, stop further sharing and follow the provider's and your organisation's appropriate incident process. Removing a visible message alone should not be treated as proof that every copy has disappeared.

For your next task, write down two lists: what the AI needs to know and what it does not. That small habit often makes the request clearer as well as more private.

Practise with fictional information using the Ask, Improve, Check worksheet.