All guides / Client data
How do we keep client data safe when using AI?
Start by leaving real client details out of early tests. Use made-up records while you decide which tools and tasks your team may use. Before sharing live data, check the exact account, who can see the files and what happens to them.
A paid account alone does not answer those questions. Use the prompt below to build a list of checks for the person who looks after your data.
Try the promptUse less data. Check access. Agree the rules.
Work out what the task needs
Describe the result you want, then ask which facts it needs. A draft about an order may need its status. It may not need a home address, a full email thread or a staff record.
More on this step
For a test, write a fresh record with invented details. Keep real names, file links and hidden notes out. The ICO’s AI guidance covers limiting personal data and keeping it secure. Ask your data lead to review the planned use before you move to real records.
Read the source: ICO: AI and data protection
Check the service and the plan
Find the terms for the exact product you will use. Check where uploads and chats are stored. Ask who has access, how long files stay and what deletion does. Include any extra apps that connect to the service.
More on this step
OpenAI says it does not train its models on business data by default. That promise does not mean a file is never stored. Keep training, storage and access as separate questions. Save the terms and settings you checked, with the date.
Read the source: OpenAI: how business data is handled
Test who can see the files
Microsoft says Copilot works with data a user already has permission to access. Check shared folders, old links and guest access before you use those files with it.
More on this step
Try an invented file first. Follow it from upload to a saved chat, shared link and download. Remove a test user’s access and check what still works. Ask your data lead how saved copies should be handled. Keep a note of anything the trial could not verify.
Read the source: Microsoft: Copilot data and privacy
Not sure where to start?
Make your data checks clear
This prompt helps you prepare questions. It does not approve a tool for client data. Keep your answers general and use invented examples.
Try this in your AI app
ChatGPT
Claude
Gemini
CodexUsing Gemini? The button copies the prompt. Paste it into the new chat.
Help me plan how our business could use AI with less client data.
Ask questions one at a time. Start with the task, the result we need and the facts it really needs. Ask which details we could leave out or replace with made-up ones during a test.
Ask which tool, plan and account we would use. Find out who is responsible for our data and who can approve this use. Do not ask me for passwords, client records or private links.
Help me list questions about storage, training, access, sharing, connected apps and deletion. Keep facts we have checked separate from things we still need to ask the supplier.
Then repeat our plan in plain English. Wait for me to correct it. Give me a table with each check, its owner, the evidence we need and the next step.
Do not claim that a paid plan or a supplier promise makes every use safe. Flag points for our data lead to decide.
Watch Warren's story
We set up a Claude Project with Warren
Warren is a hotel executive. In Leader Lab, we set up a Claude Project with notes on his role and a hotel-standards document. We checked the output against the file. He later built his own dashboard for reporting.
Read the source: Warren’s Leader Lab story
Testimonial · 0:24
"I’ve learned more than I have playing around with it in the last couple of months."
Warren Lavender · Luxury hospitality
Worked example
Test with sample client records
A firm of solicitors wants to draft a client intake email. Its test uses a made-up case and a sample list of missing details. Names, addresses and live case notes stay out. A solicitor checks the draft against the list before anyone uses it.
An accountant tests a reminder for records in the same way. The sample has a fake client, a due date and the names of files still needed. It contains no bank details or tax figures. The firm checks the account, storage and access rules before it agrees to use real records.
Made-up example.
Sample facts
Keep real case and tax records out.
Email draft
Use only the agreed intake or records list.
Firm’s check
Review the message and data handling.
A few more things to know
Give staff a short, usable rule
Write down which account staff should use and which tasks it covers. Show examples of details they must leave out. Name a person who can answer questions and approve exceptions.
Keep that rule near the place staff do the work. Walk through a sample together. Ask staff to explain it back in their own words. If a rule is hard to follow, find out why. Review the task or give them a practical route to ask for help.
Plan for a wrong upload
Agree how staff should report a file sent to the wrong place. Ask them to keep the details needed to investigate. Your data lead should assess what happened and decide what to do.
Closing a tab alone does not show that an upload was deleted. Check the service’s controls and get help through your agreed route. Use the incident to review the task and instructions. Keep a record of what you checked and what remains unresolved.
Can we just remove the client’s name?
Check the whole record. A job address, unusual event or other details may still reveal who it concerns. Use a fully invented record for a first trial, then ask your data lead about live use.
What should we check first?
Start with the intended task and exact account. Confirm which facts it needs and who approves them. Then check access, storage and sharing before staff upload real client files.