Check the Information Before You Enter It
Work through the explanation, apply it to the example, and complete the quick check before continuing.
Useful tasks can still use unsuitable data
Imagine that AI could summarise a customer complaint very well. That does not mean you may paste the complaint into any AI service.
The complaint may contain a name, phone number, account details, health information, or confidential business facts. The tool may store prompts, send data to another country, use subcontractors, or apply settings you have not checked.
Task suitability and data suitability are separate decisions. Both must pass.
A practical five-level classification
These are cautious course labels, not legal definitions. Your organisation’s policy and applicable law take priority.
Public
Information intentionally available to everyone, such as an approved public webpage or published brochure.
Public does not mean error-free or free of copyright. Check the source and permitted use.
Internal
Ordinary work information meant for people inside an organisation, such as routine process notes.
Do not assume an external AI service is approved for internal information.
Confidential
Information whose disclosure could harm a person or organisation, such as business plans, security details, unpublished results, contracts, or private complaints.
Use only an explicitly approved system and the minimum necessary information. When approval is unclear, stop.
Personal
Information related to an identified or identifiable person, such as a name joined with contact, financial, health, employment, location, or account information.
Personal information may also be confidential. Follow privacy rules, purpose limits, and approved handling processes.
Prohibited
Information that policy, contract, law, or the task owner says must not be entered into the proposed tool.
Examples may include passwords, secret keys, authentication codes, protected client records, classified material, or data collected without a valid purpose.
Synthetic does not automatically mean safe
Synthetic information is created rather than taken directly from a real record. It can be useful for learning and testing.
But replacing a name is not always enough. A rare job title, exact date, location, and unusual event may still identify a person. Synthetic data may also copy the patterns or bias of real data.
Ask whether a person can reasonably be identified and whether sensitive facts remain.
The minimum-necessary rule
Even with an approved tool, use only what the task needs.
Instead of pasting a complete personnel file to improve one paragraph, provide a fictional example or the small approved section required for the rewrite.
Less data can mean less privacy, security, and confidentiality risk.
A six-question input check
Before entering information, ask:
- What category does this information belong to?
- Do I have a valid reason and authority to use it?
- Is this tool approved for that category?
- Can I remove names, secrets, or unnecessary details?
- Do I know how the service stores, uses, shares, and deletes inputs?
- What should I do if unexpected sensitive information appears?
If any answer is unclear, pause and ask the data owner, privacy contact, security team, or other authorised person.
Quick check
You replace a customer’s name but keep their exact address and complaint details. Is the result automatically safe synthetic data?
A. Yes, because the name is gone. B. Yes, if the AI task is useful. C. No, the remaining details may still identify the person. D. No, because synthetic information is never allowed.
Check the answer
Answer: C. Identification can come from several details together. Removing one field may not be enough.
Remember
- A suitable task can still contain unsuitable input.
- Classify information before choosing or using the tool.
- Use the minimum necessary information.
- When approval or handling is unclear, stop and ask.
Now we can combine task, evidence, data, tools, and authority in one repeatable process.