What may go in and what never should

Whatever you enter into an AI tool is transmitted to an outside provider, processed there, often stored and, depending on the contract, also used to improve the models. With free accounts, the latter is the rule, not the exception.

That makes every input a disclosure to third parties, with everything that entails.

This must not go in

• Personal data: names of customers, employees or applicants, addresses, phone numbers, sick notes, salaries, application documents
• Specially protected data even less: health, religion, trade union membership, ethnic origin (Article 9 GDPR)
• Trade secrets: cost calculations, quoted prices, design data, contracts, strategy papers, unprotected inventions. Germany’s Trade Secrets Act (GeschGehG) only protects what the business keeps reasonably secret. Typing it into a free tool can forfeit that protection.
• Login credentials: passwords, keys, tokens, not even "just for testing"
• Data of customers or partners entrusted to you in confidence
• Internal documents: anything you would not give to a competitor

Uploading a cover letter to have it summarised is convenient, and at the same time it is a transfer of personal data to a third party without a legal basis. The applicant did not consent to it.

This is unproblematic

• General specialist questions and questions of understanding
• Help with wording texts without specific personal or company data
• Publicly available information
• Anonymised examples: instead of "customer Meier from Freiburg with contract 4711" simply "a customer with an ongoing maintenance contract"

Anonymising means truly anonymising: if from "our biggest customer in automotive supply in the Black Forest" anyone in the industry can work out the name, nothing has been gained.

The rule of thumb

Would I write this text on a postcard and send it to a company I don’t know? If not, it does not belong in an AI tool.

When the business uses it officially

If your business uses an AI tool for work, it needs a data processing agreement (DPA) with the provider, a clarified legal basis and a rule on whether inputs may be used for training. That is management’s job. Your job is to stick to the rules and, if in doubt, ask first. Then customer data may go into the approved tool, but only into that one.

Quick check