What never to paste in

Most AI mistakes are not dramatic. Nobody gets hacked and nobody breaks in. Someone simply pastes something into a chat window that should have stayed on their own desk, and only realises later. The good news is that this is entirely avoidable, with one rule and a short list you can hold in your head.

The one rule

If you would not put it in an email to a stranger, do not paste it into an AI tool.

That single test catches almost every case below. A chat window is not a private notebook. It is a message leaving your business and landing on someone else’s computer. Treat it that way and you will rarely go wrong.

Three categories worth knowing by heart

Customer personal data. Names tied to addresses, phone numbers, dates of birth, health or access notes, anything that identifies a real person. A salon should not paste a client’s allergy notes and full name into a chat just to tidy up the wording. A driving instructor should not paste a pupil’s home address to plan a route. This is exactly the data that data-protection rules exist to protect, and it is the one owners get caught out on most.

Financial details. Full card numbers, sort codes, account numbers, deposit references tied to a real transaction. If you are drafting an invoice chase or a payment reminder, write “[bank details here]” as a placeholder and fill it in yourself once the draft is done. AI tools are not a payment system and have no business holding this.

Anything commercially sensitive. A signed contract with a client, your genuinely confidential pricing model, a supplier agreement marked private, a tender you have not submitted yet. If a document has “confidential” on it, or you would wince to see a competitor read it, an AI chat counts as sharing it with an outside company, not tucking it in a locked drawer.

A few more worth a mention: passwords and logins, never, for any reason, staff and HR records such as salaries and disciplinary notes, and anything about a live legal or insurance matter, where you should be getting proper advice rather than typing it into a chat.

The trick: you almost never need the real details

Here is what makes all of this easy in practice. AI rarely needs the sensitive bits to do the job you actually want.

• Instead of pasting a customer’s full record: “Draft a friendly reply to a customer whose delivery is three days late and who wants to know when it will arrive.”
• Instead of pasting a signed contract: “Explain what a retention clause usually means in a building contract, so I know what to look for.”
• Instead of pasting a supplier’s pricing sheet: “Help me write a polite email pushing back on a price increase, without giving away our numbers.”

In each case, the AI does exactly the work you needed, and none of the sensitive detail ever left your desk. This habit, stripping out names and numbers and describing the shape of the problem instead, is called anonymising. It is the single most useful safety skill in this whole course.

What is genuinely fine

To balance the list: it is fine to paste your own writing to be tidied up, your own published website copy, made-up or anonymised examples, and general “how do I” questions with no private data attached. That is most of what owners actually want AI for. The list above is a small, specific carve-out, not a reason to hold back.

Try it

Next time you catch yourself about to paste in a real customer’s details, pause and ask: could I describe this instead? Nine times out of ten, you can, and the AI never notices the difference.

Next, we look at what UK GDPR actually asks of you when AI touches customer data, in plain English, no legal jargon.

The full checklist, with more examples, lives in our guide What you should never paste into an AI tool.