What not to paste into an AI chatbot, and what to do instead

It's one of the easiest things in the world to do. There's an awkward email to answer, a contract you can't face reading, a spreadsheet of customers, a CV that needs tidying. You paste it into a chatbot and a minute later you have something usable. Most of the time nothing bad comes of it. You just can't see where the stuff you typed has ended up.

My rule of thumb: treat a public chatbot as somewhere you'd be happy for the company, and maybe its reviewers, to read what you type. Leave out passwords and codes, other people's personal details, health and other sensitive information, and your employer's confidential material, or swap the real details for placeholders first. The UK's National Cyber Security Centre (NCSC) boils it down to two rules: don't put sensitive information into a public chatbot, and don't submit anything that would cause problems if it became public.

This is a UK-first guide. The legal references are to UK data-protection law, and the regulator links are the ICO's. The provider settings in the middle apply wherever you are. If you're outside the UK, check your own country's rules for the legal parts.

What happens to what you type

People tend to get this wrong in both directions. On one hand, it isn't quite true that a chatbot "learns" your message and repeats it to a stranger. In 2023 the NCSC explained that a language model is trained first and queried afterwards, and that, at the time of writing, it doesn't automatically add what you type to the model for other people to query.

That doesn't make it private, though. The same NCSC post says your query is visible to the company running the chatbot, that queries are stored and will almost certainly be used at some point to develop the service or model, and that the provider, or its partners and contractors, may be able to read them. It names further risks: stored queries can be hacked, leaked or accidentally made public; the company can later be bought by one with a different attitude to privacy; and a query can be sensitive because of who is asking and when, not only what it says. It adds that information can be pieced together across many queries made with the same login.

That post is from March 2023, so here is what the providers' own pages said when we read them on 8 October 2026. These change often; treat them as a snapshot and check the current page.

• ChatGPT (OpenAI). On its services for individuals, OpenAI says it may use your content to train its models. You can switch that off with "Improve the model for everyone" under Settings > Data controls, or through its Privacy Portal. Temporary chats aren't used to improve its models while they stay temporary. If you give a thumbs up or down, the whole conversation attached to that feedback may be used for training even if you've opted out. By default, OpenAI says it doesn't use inputs or outputs from ChatGPT Business, Enterprise or Edu, or its API, to improve its models.
• Claude (Anthropic). For its consumer plans (Free, Pro and Max), Anthropic says it uses your chats to improve its models if you choose to allow it, and may also use conversations flagged for safety review. Incognito chats aren't used to improve Claude even if you've allowed it. If you use the thumbs up or down button, it stores the whole related conversation for up to five years. Its work and API products are covered by separate terms. The page we read was dated 16 March 2026.
• Gemini (Google). Google says human reviewers, including trained reviewers from its service providers, review some chats, and asks you not to enter confidential information you wouldn't want a reviewer to see or Google to use to improve its services. Chats that reviewers have looked at are kept for up to three years, and deleting your activity doesn't delete them. Turning off Keep Activity, or using a temporary chat, stops chats being reviewed to improve Google's services, but Google says it still uses them to respond to you and for safety, including with human reviewers, and keeps them for 72 hours. The default auto-delete period is 18 months.
• Microsoft 365 Copilot (work accounts). Microsoft says prompts, responses and data accessed through Microsoft Graph aren't used to train the foundation models behind Copilot. It does store your prompts and Copilot's responses as your activity history, so "not used for training" isn't the same as "not kept".

Notice two things. A personal subscription isn't the same as a business one: OpenAI's training default applies to its services for individuals, and Anthropic's applies to Free, Pro and Max. And the safer settings tend to be switches you have to find, not the default.

The front-page test

Here's a rule that fits on a sticky note, and it's really just the NCSC's second rule in plain English: before you press send, ask whether you'd be comfortable with the company, a human reviewer, or a journalist reading it. If not, change it or leave it out. It works because it doesn't depend on knowing which provider keeps what for how long, which changes more often than anyone can follow.

What not to paste

• SecretsPasswords, codes, card numbers, keys
• Other peopleCustomers, clients, colleagues, pupils
• Sensitive detailsHealth, beliefs, ethnicity, union membership
• Work secretsUnreleased figures, contracts, source code

• Passwords, codes and keys. Passwords, one-time codes, recovery codes, card numbers, API keys, private keys, and anything else that unlocks something. No task you'd ask a chatbot to help with needs the real value, and once it's in a stored conversation you can't be sure who can see it. That includes code: look for keys and connection strings before you paste it. If you want a stronger habit around accounts, our guide to protecting your accounts covers it.
• Other people's personal details. Customers, clients, patients, colleagues, pupils, tenants. Under UK data-protection law, personal data is information that relates to an identified or identifiable person; a name or a number can be enough. The ICO says there is no "AI exemption": if you're processing personal data, the law applies, even if the personal data isn't the point of the task. And the data minimisation principle says personal data should be adequate, relevant and limited to what is necessary. A chatbot rarely needs a customer's full name and address to help you word a reply.
  One exception worth knowing: the ICO says personal data used purely for personal or household activity, with no connection to a professional or commercial activity, is outside the UK GDPR. Asking for help writing to a friend is one thing. Anything connected to work or a business is not covered by it.
• Sensitive categories of information. The ICO's special category data list, which gets extra protection under UK law, covers racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health, sex life and sexual orientation. Financial details aren't on that list, but the ICO notes that other data, such as financial data, can also be sensitive. The same goes for your own information: the NCSC's examples of sensitive queries include revealing health or relationship questions, and the stored-and-possibly-reviewed point above applies to those as much as to anything.
• Your employer's or client's confidential material. Unreleased figures, contracts, client lists, strategy, source code. In a September 2026 blog on "shadow AI", the NCSC warned that staff who put company or customer data into consumer AI services reduce their organisation's visibility and control, because the information may be stored, retained or used to improve the service unless specific privacy controls are in place. It lists the risks as data breaches, loss of intellectual property and failing to meet regulatory requirements. If you aren't sure whether you're allowed, ask first. A contract or NDA can forbid it whatever the tool's settings say.

Safer ways to get the same help

1. Swap in placeholders. Replace names, numbers, addresses and companies with "Client A", "[amount]", "[date]". Paste the structure, not the people. Take care: the legal test is whether someone is identifiable, which is wider than whether their name appears, so a job title, a place and a date together can still point to one person.
2. Describe it instead of pasting it. "A customer says their delivery arrived damaged and wants a refund; draft a polite reply that offers a replacement" gets you most of the way without a single real detail.
3. Use the settings. Switch off training or model improvement, and use a temporary or incognito chat for anything borderline. On the providers' own pages these reduce what's used for training. They don't make a chat invisible: Google, for one, says it still processes temporary chats for 72 hours.
4. Use the tool your workplace provides. If your employer has a business plan, it will have its own data terms, such as OpenAI's default of not training on Business content. Ask IT or whoever handles data protection what's approved, rather than carrying your personal account into work.
5. Be careful with shared links. OpenAI says anyone who has a link created from a personal account can view the shared conversation, which can include uploaded files and images, and any names or personal information typed into it. Its own help page tells you not to include health information, financial details, passwords or account numbers in shared content. You can find and delete your links under Settings > Data controls, but deleting a link doesn't remove copies other people have already saved.

If you've already pasted something

1. Note exactly what, where and when. You'll need it for every step after this one.
2. Secrets first. If it was a password, code or key, change or revoke it now. Don't wait to find out whether it matters.
3. Clean up what you can. Delete the conversation and any shared link, and switch off training for the future. Know the limits: Google says reviewed chats are kept for up to three years even after you delete your activity, and a link you've deleted may already have been copied.
4. At work, tell someone straight away. Under the UK GDPR, an organisation must report certain personal data breaches to the ICO within 72 hours of becoming aware of them, where feasible, and tell the people affected without undue delay if the risk to them is high. Whether pasting something counts as a breach is for your organisation to assess, and the ICO's guidance says the first job is to contain it and weigh up the consequences for the people involved. That clock runs from when the organisation knows, which is why a quick, no-blame report matters more than a perfect one.
5. If it was your own information, keep an eye on the accounts it touches, and be warier of unexpected calls, texts or emails that quote details only you should know. Our scams guide covers what to do if one arrives.

If you run a business or manage a team

Banning chatbots rarely works. The NCSC's shadow-AI post says organisations' policies haven't always kept pace, so employees turn to tools their organisation hasn't approved, and it cites one study in which 71% of employees reported using AI tools their employer hadn't approved. That figure is from third-party research as quoted by the NCSC, not something we've measured. The NCSC says it isn't recommending that people stop using AI; it recommends a positive cyber-security culture where people can talk openly about what they're using, and giving staff secure, approved alternatives.

Here's what we'd suggest (our idea, not the NCSC's): give people an approved tool; put the "what not to paste" list above on one page; and agree a no-blame way to say "I pasted something I shouldn't have". If a chatbot or automation touches customer data, you'll also want a written contract with the provider: see the data-protection section of our guide to automating a small business.

The two-futures view

In the optimistic future, AI assistants keep getting more useful, and the people who benefit most are the ones who built good habits early: placeholders instead of real names, the approved tool for work, settings checked once and kept. They get the help without handing over anything they'd regret. In the other future, a provider is breached, is sold, or changes its terms, as the NCSC warned could happen. What you never pasted can't leak. The same small habit helps in both.

Frequently asked questions

Where to go next

• How to check an AI answer before you rely on it: the other half: what comes out of the AI, and how to tell whether it's right.
• AI is making scams more convincing: the companion piece: how criminals use AI against you, and the four free habits that still work.
• Automate the boring half of your small business: including the written-contract check before customer data goes through any tool.
• The AI toolkit worth paying for: free tiers, and the data-protection checks to make before you subscribe.