ChatGPT at work without leaking your data

A company that bans AI does not end up with staff who do not use it. It ends up with staff who use it on their own phones without telling anyone. That is a worse position than setting clear rules.

The simple rule

Do not put anything in that you would not send to a stranger in an email. That is simple enough for people to remember and strict enough to cover most situations.

What never goes in

• Kennitölur and personal information about customers or staff.
• Health information of any kind.
• Passwords, keys and system credentials.
• Unsigned contracts and confidential documents from third parties.
• Salary information and personnel matters.
• Code that contains credentials or trade secrets.

What is fine

• General text that is public anyway, for example marketing copy.
• Anonymised examples where you have swapped out names and numbers.
• General questions about method, wording and structure.
• Code that contains no credentials.
• Drafts you are going to review yourself anyway.

The settings that matter

In most systems you can switch off having your conversations used for training. On business subscriptions this is usually off by default and the terms are different from free access. If your company uses this seriously then a business subscription is not just a convenience, it is a decision about data security.

One page that works

1. Which tools may be used and who pays for them.
2. The list above of what may and may not go in.
3. Who is responsible for what goes out. The answer is always the person, not the machine.
4. What to do if something goes in by accident. Speak up, do not hide it.
5. Who answers questions about this internally.

One page people read beats a ten page policy nobody opens.

Privacy in an Icelandic context

Data protection law applies the same whether the data goes into a spreadsheet or into a language model. The core is identical: you may not process personal data without a legal basis, and you are responsible for where it ends up. Stripping out names solves the majority of everyday cases.

Frequently asked questions