Pause before using real records.
Trying an AI tool with a customer email, contact list or meeting transcript can disclose information to another provider. A familiar chat box does not settle whether that use is appropriate. Start with a sample that does not identify a real person.
Name the purpose
Write down the task and why AI is needed. Consider whether a template, basic automation or a smaller input could do the job. Do not collect extra information just because a tool can accept it.
Check permission
Confirm your authority to use and share the information for this purpose. Customer consent, contracts, employer policies and sector rules may matter. Sensitive or high-impact uses need a separate review, not a quick prompt experiment.
Use the minimum data
Remove names, contact details, account identifiers and unnecessary context. Prefer synthetic examples while testing. Removing a name alone may not prevent identification if the remaining details are distinctive.
Read the actual provider settings
Check the product and plan you will use: training use, retention, deletion, access controls, storage/processing locations and subprocessors. Consumer chat products and business/API services can have different terms. Do not assume a setting in one product applies to another.
Decide who reviews the result
Check facts and private details before sending or publishing output. Keep a person responsible for decisions, especially those affecting customers, employees or access to services. A confident answer is not proof.
Plan for access and deletion
Limit who can use the tool, document where records go and set a retention approach. Know how to respond to an access, correction or deletion request before processing real information.
Is ChatGPT safe for confidential information?
It depends on the version, the plan and its settings. ChatGPT, like Microsoft Copilot and other AI assistants, comes in free, paid personal and business versions, and their terms on training use, retention and storage can differ. Don’t assume a setting in one version applies to another.
Before you paste anything confidential, check these for the exact product and plan you’ll use:
- Whether your inputs can be used to train or improve the model, and whether you can turn that off.
- How long chats and files are kept, and how to delete them.
- Who in your business can see shared chats, files and history.
- Where data is stored and processed, and which subprocessors are involved.
- Whether a business version or an existing tool you already pay for would be a better fit.
Start with sample data that doesn’t identify a real person and share as little as possible. Health, financial and client records need a separate review: see the pages for physio and chiro clinics, accountants and bookkeepers and real estate teams. This is general information, not legal advice.
A practical starting point, not legal clearance.
This checklist is general information, not legal advice or a compliance assessment. Requirements depend on your organization, the data and the purpose. Ask an appropriate privacy or legal professional about sensitive or regulated work.
Source
The Office of the Privacy Commissioner of Canada and provincial privacy authorities describe necessity, appropriate purpose, consent, transparency, safeguards and human accountability in their principles for privacy-protective generative AI (December 7, 2023). Reviewed October 6, 2026. Those principles do not replace the full requirements that apply to a particular business.
For your initial message to Oakville AI, describe the task without sending passwords, customer records or confidential documents. We discuss minimum access and tool settings before any project begins.
Free checklist
Next: check whether your business is ready for AI.
The free AI readiness checklist is a one-page companion to this guide: 10 plain-language questions and a simple score.
Start with one real task.
Talk through what you need in a free 30-minute video call. No paid work starts until scope and price are agreed.
30 minutes · Video call