Staff should never paste customers' personal details, ID or account numbers, health or family information, passwords, or confidential business documents into a public AI tool. Whatever goes into a chat box leaves your organisation, may be stored abroad, and under Kenya's Data Protection Act you remain responsible for it.
This is practical guidance, not legal advice. AI providers' terms differ and change; check the terms of the tools your staff actually use.
Why it matters
Typing into an AI tool feels private. It is not. Depending on the tool and the plan you are on, what you paste can be:
- stored on the provider's servers, often outside Kenya;
- used to improve the provider's models, unless you turn that off or use a business plan that excludes it;
- read by the provider's staff reviewing conversations for safety;
- exposed if the account is shared, its password is weak, or a browser extension reads the page.
Under the Data Protection Act 2019, your organisation is responsible for the personal data it holds, including when it sends that data to another company or another country.
The never-paste list
| Never paste | Examples |
|---|---|
| Customer and staff personal data | Names with phone numbers, ID or passport numbers, addresses, M-Pesa or bank statements, payslips |
| Sensitive personal data | Health records, biometric data, ethnicity, religion, family details, property details, sexual orientation |
| Credentials | Passwords, PINs, API keys, access tokens, recovery codes |
| Financial and payment details | Card numbers, account numbers, unreleased accounts, bank correspondence |
| Confidential business information | Contracts under NDA, tender bids, pricing strategy, board papers, unannounced plans |
| Other people's confidential material | A client's documents, a supplier's price list, legal advice you received |
Kenya's Data Protection Act treats some data as sensitive personal data: data revealing a person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details, sex or sexual orientation. That data needs extra care in any system, and has no place in a public chatbot.
What you can safely do instead
- Remove the personal details first. "A customer in Nakuru disputes a KSh 12,000 invoice" gets the same help as the customer's name and phone number.
- Use placeholders. Replace names with [Customer A] and numbers with [amount], then put the real details back in the final draft yourself.
- Describe, don't paste. Summarise a contract clause in your own words rather than pasting the contract.
- Use a business account with data controls for anything work-related, where training on your data is switched off and you can manage who has access.
- Keep a person in the loop. Check every AI draft before it goes to a customer, a regulator or a decision.
A one-page AI rule for your staff
Most organisations need only a short policy. Copy this and adapt it:
- Only use the AI tools on our approved list, with your work account.
- Never paste anything on the never-paste list. If in doubt, remove the personal details or ask.
- You are responsible for anything you send that an AI helped write. Check facts, figures and names.
- Tell your manager straight away if you think you pasted something you should not have.
- Do not use AI to make decisions about people, such as hiring, discipline or credit, without a person reviewing the decision.
- Say so when content you publish was substantially produced by AI, where our clients or the law expect it.
Review the list of approved tools every few months, and repeat the rules when you onboard a new staff member.
Before you approve a tool
An approved list only helps if each tool on it has been checked. Five questions to answer before adding one:
- Where is the data stored, and in which country? Moving personal data out of Kenya brings extra duties under the Data Protection Act.
- Does the provider train its models on your inputs, and can you switch that off for every user?
- Can you manage the accounts centrally: add and remove staff, see who uses it, and enforce two-step login?
- Can you delete conversations and data, and how quickly is it removed from the provider's systems?
- Is there a business agreement that sets out how the provider handles your data, rather than only consumer terms?
Write the answers down next to each tool on the list. When a provider changes its terms, as they often do, you will know what to re-check.
If someone has already pasted personal data
- Delete the conversation in the tool, and check whether the provider lets you request deletion of the data.
- Record what happened: what data, whose, when, which tool.
- Assess the risk to the people involved. Under the Data Protection Act, a personal data breach that poses a real risk to people must be reported to the Data Commissioner within 72 hours of becoming aware of it.
- Fix the cause: tighten the rule, train the team, or change the tool.
Check your organisation's AI rules
The free AI Readiness Score includes six questions on responsible AI, covering staff AI rules, privacy notices, consent, human review, where your data is stored and ODPC registration, and scores them separately from your overall readiness.
This information is given as a guide. Confirm it before you use it, and adapt it to your own situation.
Common questions
Is it safe to paste company data into ChatGPT?
Not personal or confidential data on a personal account. Remove personal details first, and use a business account with data controls for work.
Do AI tools train on what I type?
Some do by default on free and personal plans; business plans often exclude it. Check each tool's settings and terms.
Can I paste anonymised data?
Generally yes, if it truly cannot identify anyone. Removing the name is not always enough: a job title plus a town can identify a person in a small business.
Who is responsible if staff leak data through an AI tool?
Your organisation, as the data controller. That is why written rules and training matter.
Should we ban AI tools at work instead?
Usually not. A ban tends to push staff onto personal accounts you cannot see. Clear rules, approved tools and training protect your data better than a ban.
