Learn → AI Fundamentals

Is it safe to put this in?

This is the question people are most afraid to ask out loud. You have a document, an email or a spreadsheet, and you want the tool to do something with it, and somewhere at the back of your mind is the thought that this might not be allowed. Asking feels like admitting you already did it. So people guess.

Skip this if you already check your organisation's data rules before you put anything into an AI tool, and you know which tool you are allowed to use.

What you need

• Any device. This works on a phone.
• An AI tool you use or are about to use. You do not have to open it for most of this lesson.
• No cost. Nothing to install.
• If you are doing this for work, it helps to know whether your employer has bought an AI tool or whether people are using their own accounts. Step 5 covers what to do if you do not know.

Steps

1. Take one real thing you were about to paste in. An email, a letter, a paragraph from a document. Have it in front of you.

   You should have one specific piece of text in view, not a general worry.

2. Read it and ask: is there a living person in here who could be worked out? A name, an address, an email, a date of birth, a phone number, a case or tenancy reference, a photograph, or a detail specific enough that someone could put two and two together.

   You should be able to point at the words that identify someone, or confirm there are none. The Information Commissioner's Office defines personal data as “any information relating to an identified or identifiable natural person”, and identifiable includes indirectly — through a reference number, a location, or a combination of small details.

   Information Commissioner's Office, What is personal data?, checked 27 July 2026

3. Ask: is this mine to share? Customer records, a colleague's draft, a supplier price, an unpublished report, anything marked confidential. Ownership is a separate question from whether a person is named in it.

   You should be able to say who the information belongs to. If the answer is “the organisation” rather than “me”, that is a flag, not a stop.

4. Ask the newspaper question: if this exact text appeared in a news story tomorrow with your name attached to it, would you be comfortable? Answer honestly rather than defensively.

   You should get a clear yes or a clear flinch. The flinch is the useful answer.

5. Now check which tool it is going into. There are two kinds. A tool your employer has bought and set up, signed in with your work account. Or a personal account you opened yourself, including a free one. These are not the same and the difference matters more than anything else in this lesson.

   You should know which of the two you are about to use. If you cannot tell, treat it as the personal kind until someone tells you otherwise.

6. Read what the supplier actually says about the work tool, rather than what you have heard. For Microsoft 365 Copilot, Microsoft states in its enterprise data protection documentation that “the prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation models”. Other suppliers say different things. Find the sentence, not the reputation.

   You should have found one sentence from the supplier, on the supplier's own site, about what happens to what you type.

   Microsoft, Enterprise data protection in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, checked 27 July 2026

7. Decide, using this order. If there is a person in it and you are on a personal account: do not paste it. If there is a person in it and you are on a work tool your employer set up: check your organisation's rule first — the tool being approved is not the same as the data being approved. If there is no person in it and it is yours to share: go ahead.

   You should have a decision for the specific piece of text from step 1, and be able to say which of the three cases it fell into.

8. If the answer was no, try taking the person out instead of giving up. Replace names with a letter. Replace an address with “their address”. Replace a reference number with nothing. Most of the time the tool does not need the person to do the job.

   You should have a version of the text that would be no use to someone trying to identify anybody, and that still asks the same question.

If it goes wrong

You cannot find out whether your employer has a rule.

Ask the person who sent the email announcing the tool. If nobody sent one, ask your line manager in writing and keep the reply. Asking in writing is protection. If there is still no answer, work as though the answer is no.

The tool is approved, so you assume the data is approved.

These are two separate decisions and they are often made by two different people. A licence says the software is allowed. It says nothing about whether tenant records, HR files or safeguarding notes may go into it.

You already pasted something you should not have.

Tell someone today rather than hoping. In most organisations that is your line manager or the person who handles data protection. Delete the conversation if the tool lets you, note what you pasted and when, and say so. Reported early it is an incident. Found later it is a different conversation.

You strip out the name but leave a detail only one person could have.

“The tenant in flat 3 who had the leak in March” identifies somebody. So does a case reference. Read your stripped version as though you were a nosy neighbour, not as though you were the author.

If you want to go further

Optional. Nothing in this lesson depends on it.

• Explore responsible AI — Microsoft Learn, free, no account needed to read

Sources used on this page

• Department for Education, Essential digital skills standards: 2026, 15 July 2026
• Information Commissioner's Office, What is personal data?, checked 27 July 2026
• Microsoft, Enterprise data protection in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, checked 27 July 2026
• Skills England, AI foundation skills for work, 28 January 2026

---

Skills England · Responsible and ethical AI foundation skills · source

DfE · Being safe and legal online, Level 2 · source

---

Written by · Craig Stanley · drafted 27 July 2026 · not yet signed

When this lesson is published it will carry a name, a published date and a last-checked date. It does not carry one yet, and this page says exactly what that signature means.