Protect business data in generative AI by approving specific tools and account types for specific data classes, minimizing what is sent, confirming current contractual and technical controls, restricting access, setting retention and deletion rules, and preparing a response path for accidental disclosure. Do not assume that a provider name, paid tier, private deployment, or “no training” statement answers every privacy and security question.
The relevant object is the complete data flow: user device, application, provider, plugins or tools, logs, retrieval store, support systems, backups, and downstream records.
Classify use before selecting a tool
Create a short decision table tied to the organization’s real obligations. Useful categories may include:
- public and approved-for-publication information;
- routine internal information with limited impact;
- confidential customer, employee, financial, contractual, or operational data;
- regulated or specially restricted information;
- credentials, secrets, authentication material, and security-sensitive configuration.
For each category, state whether it may be used in an approved AI workflow, what transformation or redaction is required, which account and region are allowed, who may access results, and how long records are retained. Sector rules, contracts, employment obligations, and jurisdiction may require qualified legal, privacy, or compliance review.
The NIST Privacy Framework provides a structure for identifying and managing privacy risk. A classification table should connect to those broader governance and accountability decisions rather than stand alone as an employee tip sheet.
Verify the actual product and contract
Provider terms can differ across consumer, business, enterprise, API, preview, and third-party offerings. Review:
- whether inputs and outputs may be used for model improvement;
- retention periods and available controls;
- deletion behavior and backup limitations;
- data location and subprocessors;
- administrator and support access;
- encryption and key-management options;
- audit logs and identity integration;
- incident notification and contractual commitments;
- whether connectors or plugins send data to another party.
As one provider-specific example, OpenAI publishes business data commitments for listed products and its API. Use the current documentation and agreement for the exact service; do not extend that statement to a different tier, feature, or vendor.
Minimize and separate data
Send only the fields required for the task. Remove identifiers when they are not needed, use representative synthetic examples during early testing, and keep secrets out of prompts and training files. Limit retrieval indexes to approved sources and apply document-level access rather than assuming anyone who can use the assistant may see every indexed record.
The Federal Trade Commission’s Start with Security guide emphasizes collecting only needed information, restricting access, retaining information only as long as there is a legitimate need, and disposing of it securely. Those practices apply to the surrounding AI workflow even when the model provider offers additional controls.
Treat external content as untrusted
An AI system may process documents, emails, websites, or messages that contain instructions intended to manipulate its behavior. OWASP describes prompt injection as a risk that can arise directly from user prompts or indirectly through external content.
Controls should assume malicious text can reach the model:
- separate trusted instructions from retrieved content;
- restrict tools and data by identity and least privilege;
- allow-list actions and destinations;
- validate structured outputs before use;
- require confirmation for consequential actions;
- prevent a model response from directly becoming code, a query, or a transaction;
- log source access, tool calls, approvals, and failures.
Sanitizing input may reduce some attack paths, but it is not a complete control because natural-language instructions cannot always be classified reliably.
Define an approved-use workflow
A usable policy tells employees what to do, not only what to avoid. Include:
- Approved tools, accounts, and owners.
- Examples for each permitted data class.
- Prohibited data and actions.
- A process for requesting a new use case.
- A reporting path for accidental disclosure or suspicious output.
- Review dates tied to provider, feature, and policy changes.
Provide a lower-friction approved path. If the sanctioned process cannot accomplish routine work, employees may create unmanaged copies or use unreviewed tools. Monitor the workflow and improve it rather than assuming publication of a policy proves compliance.
Plan for accidental disclosure
An employee may paste a secret, a connector may expose an unauthorized document, or an agent may send data to the wrong destination. The response plan should identify who can disable access, revoke credentials, preserve evidence, contact the provider, assess affected records, determine notification obligations, and communicate internally.
NIST SP 800-61 Revision 3 provides incident-response recommendations aligned with cybersecurity risk management. Tailor the plan to the organization and involve appropriate incident-response, legal, privacy, insurance, and regulatory advisers.
Decide whether the use case should proceed
A workflow may proceed when its data class is allowed, the contract and configuration meet the requirements, access is enforceable, output can be validated, and residual risk has an accountable owner.
It should pause when the organization cannot determine where data flows, a connector bypasses existing permissions, deletion and retention are incompatible with obligations, the model has more authority than the task requires, or no one owns incidents and source changes.
Our security approach describes how we frame permissions, secrets, human control, and recovery. See AI agent development for tool-boundary work and custom software for owned application architecture. An active disclosure or incident requires the organization’s response process, not a general project inquiry.
