The Paste Test: What Your Team Can Safely Put Into AI

Passwords, API keys, tokens, connection strings

A credential pasted into any chat box must be treated as disclosed, immediately and permanently. It is now in a log, a prompt history, a support tool and possibly a training set, and no retention promise can un-know it. This is the one category where there is nothing to weigh up.

Not primarily a privacy question. It is an access control failure, and in a regulated environment it is a reportable one. If the credential reached anything holding personal data, the clock on a breach assessment has already started.

The rule to write down. Credentials never go into an AI tool, in any circumstance, including to ask what is wrong with them. Rotate anything that already has.

Health, biometric, genetic, sexual orientation, religion, union membership, criminal matters

This is the data class where a mistake is not recoverable by apology. Health records and biometric identifiers pasted for summarising or drafting are being processed by a new processor, in a new place, usually with no record that it happened.

Under the GDPR, Article 9 prohibits processing special category data unless a specific condition applies, and legitimate interests is not one of them. There must also be a lawful basis under Article 6, a record of the processing, and a controller to processor contract with the AI provider under Article 28. An employee pasting into a consumer tool has none of those.

The rule to write down. Special category data goes only into a named system approved for it in writing, never into a general assistant, and never as an example.

Customer names, emails, addresses, order or account records

Pasting a customer list to reformat it is processing personal data through a third party. It is lawful only if the organisation has decided it is, in advance, and can show it. Most cannot, because the decision was never made, it was improvised by whoever had the deadline.

The GDPR needs a lawful basis, transparency to the data subject, a processor contract, and a transfer mechanism if the provider processes outside the EEA or UK. The failure is rarely the paste itself. It is that no record exists, which turns an arguable decision into an indefensible one.

The rule to write down. Personal data goes only into tools already covered by a signed processor agreement, and the list of those tools is short, written down, and known.

Contracts, term sheets, or anything received under an NDA

Disclosure to a third party is disclosure, whether the third party is a person or a service. Most non-disclosure agreements permit sharing only with named categories of recipient, and a general AI provider is not usually one of them.

Contractual rather than regulatory, which makes it easier to overlook and no less expensive. The counterparty does not need to prove damage to enforce a breach, and the disclosure is usually discoverable from your own logs.

The rule to write down. Nothing received under an NDA is pasted anywhere until someone has read what the NDA permits. If nobody has read it, the answer is no.

Unreleased results, forecasts, deal terms, anything price sensitive

Draft numbers pasted in for a cleaner summary have left the perimeter before they were announced. For a listed company or anyone advising one, the exposure is not embarrassment, it is a regulator asking who had access and when.

Market abuse and insider dealing regimes require issuers to control inside information and keep lists of who holds it. A tool that received the numbers and cannot be listed is a hole in that control.

The rule to write down. Price sensitive material stays inside approved systems until it is public. After announcement, the same text is usually fine.

Employee records, candidate CVs, performance notes, grievances

The most frequently pasted sensitive category, because summarising CVs and drafting reviews is exactly what these tools are good at. It is also the category where the person affected has the strongest interest and the least visibility.

Personal data, so everything under customer data applies. In addition, using AI to assess candidates or employees engages employment rules directly: Illinois requires notice, explanation and consent for AI analysis of video interviews and prohibits AI with a discriminatory effect in employment, Maryland requires consent for facial recognition in interviews, and New York City requires an annual independent bias audit of automated employment decision tools. Our own answer page covers what is and is not required, including the fact that no US law requires you to train staff on any of it.

The rule to write down. HR data goes only into approved systems, and any AI that influences a hiring or performance decision is a decision the organisation must be able to explain and defend.

Source code, infrastructure config, internal architecture

Usually acceptable and occasionally catastrophic, and the difference is what the code contains. Code carrying embedded credentials, customer data in fixtures, or the specific mechanism that is your actual advantage is not the same as a utility function.

Trade secret protection depends on reasonable steps to keep the thing secret. Disclosure to a provider whose terms permit training can undermine that status, which is a loss you cannot buy back. Check whether your enterprise tier trains on your input, because the consumer tier often does and the enterprise tier often does not.

The rule to write down. Code is fine in an approved tool on a no-training tier. Scan for secrets before pasting, and keep the crown jewels out regardless of tier.

Internal strategy, board material, restructuring plans

Rarely a legal problem and often a commercial one. The realistic risk is not the provider reading it, it is the same document arriving in a support ticket, a prompt log, or a screenshot in a chat with someone who should not have it.

Mostly governance rather than statute, unless it touches people or markets, in which case the categories above take over. The question a board will ask afterwards is whether a policy existed, not whether the tool was good.

The rule to write down. Approved tools only, and remember that anything about a named employee has become personal data whatever the document is called.

Published material, public filings, your own marketing copy

Nothing that has not already happened. Public material is public, and refusing to let people use AI on it is the fastest way to make them use it on everything else somewhere you cannot see.

None from disclosure. Ordinary duties still attach to what you do with the output, particularly accuracy and, where the output is shown to people, the transparency expectations that now apply to synthetic content.

The rule to write down. Encourage this. A policy that only forbids gives people no permitted path, and an unusable policy is the reason shadow AI exists.