Is it safe to put this in?
This is a draft
The steps below were written but have not yet been performed end to end on a real machine, and the time is planned rather than measured with a stopwatch. Four of the twelve checks are outstanding. The teaching is sound; treat the timings and the failure list as provisional. What that means
After this you will be able to
Decide whether a piece of information is safe to give an AI tool, under UK data protection rules.
Skip this if you already look up what your organisation allows before you paste anything in. If you are not sure your organisation has any rules at all, stay — that is lesson 12, and it is the more common answer.
Before you start. Without looking back: what are the three kinds of thing lesson 1 said an AI tool actually is?
(A chatbot, an assistant inside software you already use, and automation somebody set up.)
This is the question people are most afraid to ask out loud, usually because they think everybody else already knows the answer. Nobody does. There is a three-step check and it takes about a minute once you have done it twice.
The most common way this goes wrong is not a data breach. It is somebody pasting a complaint letter in to get help replying, and not thinking of the name at the top as information.
What you need
- A device you can type on, or a piece of paper.
- No account, no licence, nothing to install.
- Nothing real goes into anything during this lesson.
The steps
- Open a blank note on your own device, or take a sheet of paper, and write down the thing you were about to paste in.You should be looking at your own words, on your own machine, with nothing sent anywhere yet.
- Go through it and underline anything that names a person, or could be traced back to one.You should have underlined names. You should also have underlined job titles, addresses, reference numbers, dates of birth, and anything about somebody's health, money or household.
- Ask the question that decides it: if this appeared in an email to somebody outside your organisation tomorrow, would that be a problem?You should get a clear yes or no. If what you get is "it depends", treat it as a yes.
- If the answer was yes, rewrite it with the specifics taken out, and check that the rewritten version still asks for what you actually need.You should have two versions in front of you: the original, which stays on your machine, and a general one that could go in.
Try this one first
"Can you rewrite this: Mrs Patterson at 14 Elm Road has complained twice about the boiler and we still haven't been out."
Underline Mrs Patterson and 14 Elm Road. Answer to the question: yes, that would be a problem. So it does not go in as written. What does go in: "rewrite this — a tenant has complained twice about a boiler and we have not attended." The rewrite you get back is just as useful, because the tool was never using her name to do the writing.
If it goes wrong
You cannot tell whether a job title counts. If only one person holds that title, it counts. "The night duty manager at the Blyth site" identifies somebody as surely as their name does.
Your organisation has a tool it says is safe. It may well be, and the assurance may be sound. That is a different question from whether the information is yours to share in the first place. Ask who signed it off and what it covers.
You take the names out and the answer comes back useless. That usually means the task genuinely needed the specifics, which means it is not a task to hand over. Do that one yourself. This is a good outcome, not a failed lesson.
Somebody tells you it is fine because the tool does not train on your data. That is one risk of several, and it is the one vendors answer because it is the one they can. It says nothing about who inside your organisation can see the conversation, or how long it is kept.
Do today
Find one real thing you were going to paste into an AI tool this week. Run the three steps on it. Either rewrite it so it passes, or decide not to use the tool for that one.
Where else this works. The same three steps work before you put something into a translation site, before you forward a document to a supplier, and before you put a photo of paperwork in a group chat.
Practice card for this lesson — one page of A4, no email address needed.
Did this work? If it did not, say what happened — hello@howtobedigital.com
Every failure anybody sends in ends up in the section above.
Checked by a person · not auto-published
Published 14 July 2026 · Last checked 14 July 2026
8 of 12 checks passed — see which four are outstanding
Covers: Skills England, Responsible and ethical AI foundation skills · Department for Education, Being safe and legal online, Level 2
Next
AI FundamentalsAsking for something and getting it first time12 minutes · write a request that includes the task, who it is for, how long it should be, an…