Picture a bank customer-care officer who pastes a long complaint email into a free chatbot and asks for a polite reply. The email contains the customer's full name, phone number, account number and a transaction dispute. The reply comes back in ten seconds and looks great. But that customer's details have now left the company's systems, and nobody approved it.
This is the most common way AI causes trouble at work. It rarely involves hacking. It's a helpful shortcut taken by a busy person. This guide shows you how to keep the speed and drop the risk, whether you work in a bank, a clinic, a school, a logistics firm or run a small shop with a few staff.
Why pasting data into an AI tool is different from using a calculator
A calculator keeps nothing. Many online AI tools, by contrast, send what you type to servers run by another company. What happens next depends on that tool's terms, your account type and your settings. Some services may store conversations, let staff review them for quality checks, or use them to improve their systems. Others offer business plans with stricter terms. You can't know which applies by looking at the screen.
So the safe habit is simple: treat any text you enter in a public AI tool as something you are sending to an outside company. If you wouldn't email it to a stranger, don't paste it in.
What counts as customer data
Many people think only passwords and card numbers are sensitive. The list is much wider. Nigeria's data protection law (the Nigeria Data Protection Act 2023, enforced by the Nigeria Data Protection Commission) deals with personal data in general. Ghana, Kenya and South Africa have their own data protection laws too, such as South Africa's POPIA and Kenya's Data Protection Act. The details differ by country, so check your own regulator's website.
In practice, treat these as sensitive:
- Names combined with phone numbers, emails or addresses
- BVN, NIN, passport, driver's licence or tax numbers
- Account numbers, card details, transaction histories
- Health records, school results, HR files and salaries
- Photos of IDs, receipts or documents that show personal details
- Contracts, pricing lists, client lists and unreleased plans (business-sensitive even if not personal)
The five-step habit: strip, shrink, substitute, check, record
- Strip identifiers. Remove names, numbers, addresses and anything that points to one person. Replace with labels like [Customer A], [Account], [Date].
- Shrink the input. Paste only the part the AI needs. If you want help with tone, paste two sentences, not the whole thread.
- Substitute fake examples. When you need help with a format, such as a spreadsheet formula or a template, build it with made-up data and apply it to the real file yourself.
- Check the output. AI can state wrong facts confidently. Verify any figure, policy or legal claim before it goes to a customer.
- Record what you did. If your employer allows AI, note which tool you used and for what. It protects you if questions come later.
A worked example (hypothetical)
Say you work at a small online store in Abuja. A customer, Mrs Okafor, writes angrily that her order of ₦45,000 arrived damaged. Her email gives her address, phone number and order number.
Risky prompt: pasting the full email and asking for a reply.
Safer prompt: "A customer says her order arrived damaged and she wants a refund. Write a calm, short reply that apologises, asks for photos of the damage, and explains we will respond within two working days. Keep it under 120 words."
The second version contains no personal data and gives the AI everything it needs. You then add her name and order number yourself in your email app. It takes thirty extra seconds and removes the exposure. For better prompts generally, see our prompting basics guide.
Tasks that are usually safe, and tasks that aren't
| Task | Risk level | How to do it safely |
|---|---|---|
| Drafting a generic email or template | Low | Describe the situation without names |
| Explaining a spreadsheet formula | Low | Use dummy rows |
| Summarising a public report or article | Low | Fine if the document is public |
| Summarising a customer complaint thread | Medium | Anonymise first, or use an approved tool |
| Analysing a sales export with customer names | High | Remove name and contact columns, or do not upload |
| Uploading IDs, medical records, contracts | Very high | Don't, unless your employer has approved the tool in writing |
| Pasting passwords, API keys, internal login links | Never | Never share these with any AI tool |
Check settings and accounts, but don't rely on them alone
Most AI services have privacy settings, and some let you turn off use of your chats for training. Look for them in your account menu and read the plain-language privacy page. Settings differ between free and business plans and can change, so check the current terms yourself rather than trusting what a colleague says.
Even with good settings, anonymising first is still wise. A setting is a promise from a company. Removing the data is under your control.
Also use work accounts only if your employer has approved them, and personal accounts only for non-sensitive tasks. Never sign in to AI tools using a shared office login without permission.
If you run a small business or team
You don't need a 40-page policy. A single page that everyone signs is enough. Include:
- Which AI tools are approved, and for what tasks
- A list of data that must never be entered (use the sensitive list above)
- A rule that a human reads and approves anything sent to a customer
- Who to tell if someone pastes something by mistake
If you handle customer data regularly, check whether you must register with or report to your country's data regulator. Ask a licensed lawyer or compliance adviser; don't guess.
If you work for someone else
Ask before you assume. A short message to your manager or IT team works: "Are we allowed to use AI tools for drafting, and is there any data I should never enter?" Having that answer in writing is useful. Some employers ban public AI tools entirely, and breaking that rule can cost you the job even if nothing leaks.
If you are a freelancer, the same applies to your clients' material. Your contract may include confidentiality terms that cover AI tools. Our piece on contractor vs employee explains why your obligations may differ from a staff member's.
Common mistakes
- Screenshots. People think a screenshot of a document is safer than text. It isn't; it contains the same data.
- "Just this once." One urgent upload sets a habit. Build the anonymising step into your routine.
- Trusting file-name cleaning. Renaming a file does nothing if the content still names people.
- Believing the output. AI-written replies can promise refunds or policies your company doesn't have.
- Using unknown apps. Free "AI" browser extensions and random apps may be worse than major tools. Don't install them on work devices.
If you already pasted something you shouldn't have
- Stop and don't paste more.
- Note what was shared, when, and in which tool.
- Delete the conversation if the tool allows it, knowing that deletion may not remove every copy.
- Tell your manager or data protection contact quickly. Early reporting is treated far better than discovery later.
- If it included passwords or keys, change them immediately.
Frequently asked questions
Is it safe if I only paste the customer's first name?
A first name alone is low risk, but combined with a complaint detail or location it can identify someone. Use a label instead.
Can I use AI to translate a customer's message?
Treat it like any other customer text. Remove identifiers first, and for sensitive matters use a translator your employer has approved.
Does a paid plan make it safe?
Not automatically. Paid business plans often have stricter terms, but you need to read them and get your employer's approval for sensitive data.
Will I get in trouble for using AI at all?
Only if your employer forbids it or you misuse data. Ask for the rules first.
Your next step
Today, write down the three tasks where you most often want AI help. Rewrite each as a prompt with no real names or numbers. Then send your manager one question about what's allowed. That's the whole system.
Results from any side hustle or online work vary widely, and nothing here is a promise of income. Be wary of anyone who asks you to pay upfront to start earning.