Nov 8, 2026 · CloudMount editorial
Generative AI at Work: Keep Sensitive Data Out of Prompts
Generative AI can improve productivity, but prompts and uploaded files can expose personal data and commercial information. Irish business leaders should make safe use an operational requirement, not simply a staff warning.
Treat prompts as data disclosures
When employees paste customer records, contracts or internal correspondence into an AI service, they disclose information to another system. The exposure depends on the service’s terms, configuration, retention practices and access controls. An enterprise licence does not, by itself, establish GDPR compliance.
Approve specific tools and permitted uses. Prohibit credentials, unnecessary personal data and commercially sensitive material unless the environment and purpose have been assessed. Removing names alone may not anonymise a document: roles, locations and contextual details can still identify someone.
Check the service and its connections
Before deployment, establish whether inputs and outputs are used for model training, how long they are retained, who can access them and where processing occurs. Check deletion arrangements, subprocessors, contractual protections and any international transfer safeguards. A no-training commitment is not a no-retention guarantee.
For personal data, document the purpose, lawful basis and relevant controller–processor roles. Address transparency obligations and assess whether a data protection impact assessment is required. Connected assistants need particular care: restrict access to necessary repositories and require approval for consequential actions. Malicious instructions hidden in retrieved content can attempt to redirect an assistant or expose information.
Make safe behaviour easy to follow
Give staff approved alternatives, practical redaction examples and a clear reporting route for accidental disclosures. Apply proportionate monitoring without turning prompt logs into a second store of sensitive data. If an incident occurs, contain it promptly and assess whether GDPR breach notification duties arise.
This article is general information, not legal advice. Practical takeaway: choose one accountable owner, publish a short permitted-use policy and verify retention, training and connector settings before expanding AI access.
General information only, not legal advice. Regulatory obligations depend on your role, context and the provisions in force.
Want to talk about your compliance?
Book a review