Count the personal subscriptions. On personal ChatGPT workspaces (Free, Plus and Pro), data sharing is on by default; each account can switch it off.
Treat what was pasted as gone. Client or proprietary data pasted into a public chatbot may feed future training, and there is no going back.
Read your vendors' sub-processor lists. The draft-reply feature in your support desk often runs on a model provider you may not have meant to send data to.
Put a filter before the model. Prompts are checked before they leave, then blocked, swapped or stripped.
Prefer swap or strip to block. The model still understands a request with synthetic values in the same format, and performs just as well without a customer's identity.
Company data reaches outside models through everyday tools. Netskope Threat Labs' 2026 Cloud and Threat Report put the average organization at 223 incidents a month of sensitive data going to AI apps. Over the past year, source code led the data categories involved in genAI data-policy violations, ahead of regulated data and intellectual property. The routes are ordinary: a personal subscription, a writing feature inside software you already pay for, an internal chat tool built on a public model. You handle each one at the boundary, before the data leaves.
The three checks
A public chatbot keeps everything typed into it. As of 29 October 2026, OpenAI's help pages put data sharing on by default on personal workspaces with ChatGPT Free, Plus or Pro. The setting can be switched off per account, and chat history stays. By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces, or inputs and outputs through the API Platform, to train its models. Executives paste profit-and-loss statements, recipes and proprietary material into public chatbots, often without turning training off. Where every employee of a small firm buys a personal subscription, tight IT security has become wide-open exposure.
A wrong answer can be checked and fixed. Client or proprietary data that went into a public chatbot may feed its future training. There is no going back. Ask which tools staff have been pasting into. Count that material as outside your control.
The summarize button in your team wiki, or the draft-reply feature in your support desk, often runs on a third-party model provider. The vendor's sub-processor disclosure names it. Content pasted into the feature probably reaches that provider, a destination your organization may not have intended. Pull the disclosures for your paid software, and name the model providers behind each AI feature.
Block, swap or strip
Put a filter between staff and the model. It intercepts each prompt in the browser or in code before it reaches the provider. It detects sensitive content, then blocks it, deletes it or asks the user for a business justification.
A healthcare-related client built its internal chat interface on a public model and added sensitive-data filtering. Support agents there had been pasting patient case details into prompts. You decide, category by category, what the filter does with sensitive content.
What the user sees
What the model gets
When it fits
Block and ask why
The prompt stops, with a request for a business reason
Nothing sensitive leaves
Secrets, keys, regulated data with no safe substitute
Swap in synthetic values
The request goes through
The same request, with synthetic values in the same format
The format matters more than the values, and the request still makes sense to the model
Strip names
The prompt goes through with the name removed
The request, minus the customer's identity
Support tickets: the model performs just as well without the identity
Exercise (20 minutes): map your company's leaks, then choose block, swap or strip
Use your own company. Walk the card through the three checks: the personal subscriptions on your team, the AI features inside the software you already pay for, any internal chat tool built on a public model. You won't know every line yourself; nobody does on a first pass. Every line you can't fill gets an owner and a date before you close the card. The card download includes a filled-in example of a company that isn't ready yet, and why.
AI data-leak checklist (PDF)
A blank card and a filled-in example, one page each.
These three prompts go into your company's approved AI assistant. Use the first to fill in the card one row at a time; it won't guess a number for you. Use the second when the card is done, to hear the case that the leaks are still open. The third asks about your industry and your tools and turns the lesson into a 30-day plan, with a checklist, rubric or brief for your boss if you want one. Use placeholders for company, system and people names; the help doesn't depend on them.
Prompt 1: Fill in my card with me
Paste this, then add your company in one or two sentences and the card below.
Prompt
Prompt from The AI Decision Course by Dr. Tony Hoang, host of The Artificial Intelligence Podcast (Spotify, Apple Podcasts): tonyphoang.com/learn
Before you start: use your company's approved AI assistant, not a personal account. Replace company, system, supplier and people names with placeholders (Company A, System X) and round any figures. The help you get does not depend on them.
You are helping me fill in an AI data-leak checklist for my company. The card is pasted at the end.
Rules:
- Ask me about one row at a time, in order, and wait for my answer before moving on.
- Write down only what I tell you. Never suggest, estimate or invent a number, a name, a yes/no answer or a decision for me, even if I ask you to guess. If I ask, say that this row needs a real answer and ask who could give it.
- If I don't know an answer, write "Not known" and ask who should find out and by when. Put that in the Owner / by when column.
- After the last row, show the whole card as a table with three columns: Question, Answer, Owner / by when. Then list every row marked "Not known" with its owner, and remind me that any unanswered row means that route stays open.
My company in one or two sentences: [DESCRIBE YOUR COMPANY: SIZE, SECTOR, THE AI TOOLS PEOPLE ALREADY USE]
The card:
[PASTE THE CARD]
Prompt 2: Stress-test my card
Paste this, then your filled card.
Prompt
Prompt from The AI Decision Course by Dr. Tony Hoang, host of The Artificial Intelligence Podcast (Spotify, Apple Podcasts): tonyphoang.com/learn
Before you start: use your company's approved AI assistant, not a personal account. Replace company, system, supplier and people names with placeholders (Company A, System X) and round any figures. The review does not depend on them.
Below is an AI data-leak checklist I filled in for my company. Act as a sceptical reviewer at the decision meeting and argue the case for NOT READY.
For each row:
- Say whether the answer is specific enough to act on (a number, a named role, a date) or too vague.
- Point out where answers contradict each other, for example an account counted as covered while training is still on, or a route listed as filtered when no filter reaches it.
- Say what evidence you would ask for before accepting it.
Do not rewrite my answers and do not invent facts about my company. If a row is blank or says "Not known", treat it as not ready.
Finish with: your recommendation (READY, NOT READY or RE-CHECK), the three rows that most need work, and one question I should ask my team on Monday.
My card:
[PASTE YOUR FILLED CARD]
To paste the card into prompt 1, copy its rows from the PDF.
Prompt 3: Make it yours
Paste this and answer its four questions.
Prompt
Prompt from The AI Decision Course by Dr. Tony Hoang, host of The Artificial Intelligence Podcast (Spotify, Apple Podcasts): tonyphoang.com/learn
Before you start: use your company's approved AI assistant, not a personal account. Replace company, system, supplier and people names with placeholders (Company A, System X, Supplier B).
You are helping a leader apply one lesson to their own situation. The lesson's five decisions are below. Use only them and what I tell you. Never invent facts, numbers, vendors, laws or results about my organization or my industry. Where a number is needed and I have not given one, say what to measure and who should measure it, instead of guessing.
First, ask me these four questions, one at a time, and wait for each answer:
1. My industry, and roughly how many people work in my organization.
2. The AI tool or route I have in mind, in one or two sentences.
3. Where it stands today: staff already pasting into outside tools, an AI feature about to be switched on, or a filter being considered.
4. What worries me most about it.
Then give me the following. Keep it short and practical:
A. My plan. For each of the five decisions: one action written for my situation, the role that should own it (a role, not a name), and what should be done within 30 days. If my industry makes a decision harder, for example regulated data, client confidentiality or source code, say which decision and why in one sentence.
B. Three questions to ask my team on Monday, specific to my situation.
C. Ask me which one I want: a checklist for my AI tools, a rubric to score my filter rules, or a one-page brief for my boss. Then write it, and finish with a prompt I can paste later to update it.
Mark anything that rests on an assumption with "(check)".
The five decisions:
1. Count the personal subscriptions. On personal ChatGPT workspaces (Free, Plus and Pro) data sharing is on by default: switch training off on each account, or move the work to a workspace that stays out of training by default.
2. Treat what was pasted as gone. Ask which tools staff have been pasting into, and count that material as outside your control: client or proprietary data pasted into a public chatbot may feed future training, and there is no going back.
3. Read your vendors' sub-processor lists. The draft-reply feature in your support desk often runs on a model provider you may not have meant to send data to. Pull the disclosures for your paid software and name the outside model provider behind each AI feature, including the summarize and draft-reply buttons.
4. Put a filter before the model. On every route, in the browser or in code, prompts are checked before they leave, and sensitive content is then blocked, swapped or stripped.
5. Prefer swap or strip to block. The model still understands a request with synthetic values in the same format, and performs just as well without a customer's identity. Decide category by category what the filter does, and reach for swap or strip before block.
Your company's assistant may answer differently, so read what it writes before you use it.
Check yourself
An executive on your team pastes the P&L into a personal chatbot account to speed up month-end. What comes first?
Show the answer
Switch training off on that account, or move the work to a workspace that stays out of training by default. Then treat that P&L as already outside your control.
Your support desk has quietly turned on an AI feature that drafts ticket replies. Where do you look?
Show the answer
The vendor's sub-processor disclosure. It names the outside model provider the feature probably sends content to.
The filter catches a support ticket with a customer's name in it. Block, swap or strip?
Show the answer
Strip the name. The model performs just as well without the identity.
A team wants to paste live case files into an internal chat tool built on a public model. What must exist first?
Show the answer
A filter in front of the model, set to stop or strip the regulated fields.
Someone says the risk is overblown because outputs get reviewed anyway. Do you accept that?
Show the answer
A reviewed answer can be fixed. What went into a public chatbot may feed future training, and there is no going back.
Sources
The advice draws on interviews with the head of an enterprise-software and AI provider for manufacturers, the co-founder of a data-security startup, the founder of a generative-AI platform for customer support and the chief executive of a legal-analytics company.
Netskope Threat Labs, "Cloud and Threat Report: 2026", 6 January 2026. (https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026) What the count holds: detections raised by Netskope's secure web gateway across its customer base, 1 October 2024 to 31 October 2025. A "violation" is a customer-configured data-loss-prevention rule firing on a prompt or upload, not a confirmed leak. The "average organization" figure hides a wide spread: the top quarter of organizations see 2,100 incidents a month. Netskope sells the controls it recommends, and only customers with the rules turned on are counted; the report itself calls its doubling of incidents "likely an underestimation," because 50% of organizations lack enforceable data protection policies for genAI apps.
OpenAI Help Center, "Data controls in ChatGPT", read 29 October 2026, when the page showed "Updated: 3 days ago". (https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt) Personal workspaces (ChatGPT Free, Plus and Pro) have data sharing on by default; the setting can be turned off per account while keeping chat history. By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces, or inputs and outputs through the API Platform, to train its models. Two edges: temporary chats "may be retained for up to 30 days for safety purposes," and feedback such as a thumbs-up can send the whole conversation into training even after opting out. The page can change; read it the day you rely on it.