How to Protect Business Data While Implementing AI

Start with a list, not a tool. Write down every kind of data the assistant would need to read, then sort each kind into public, internal or sensitive before anyone connects anything to anything. Public covers pricing and marketing copy, internal covers supplier terms and procedures, and sensitive covers customer personal data, financial records, health information and client confidentiality agreements. One sort drives every later decision.

Take a diagnostics lab chain that wants an assistant to search lab protocols and equipment manuals, which are internal documents a reasonably vetted tool can index without much worry. Patient results belong to another tier. Keep them out of the assistant’s reach, and allow an exception only when someone names a verified reason and the control that makes it safe.

Record the owner beside every tier. List the source system, the person who owns it and the date the tier was last reviewed, so a spreadsheet nobody opens does not become the only record.

A landing page line like “we take your privacy seriously” is not a policy, but the written terms for your exact product tier are. Check two things in those terms. One is whether your inputs and outputs train the provider’s models, and the other is how long the provider keeps your data on its servers before deleting it.

As of September 2026, Anthropic states that commercial customers on its API and Claude for Work are not used for model training by default. API inputs and outputs are deleted from its backend within 30 days of receipt, unless legal or safety reasons require longer or the customer has a zero-data-retention agreement. Anthropic Privacy Center, checked 8 September 2026. OpenAI states that by default it does not use data from ChatGPT Enterprise, ChatGPT Business or its API platform to train its models. Eligible API customers can also choose zero data retention, under which prompts and responses are not stored once a request has been processed. OpenAI privacy pages, checked 8 September 2026.

Defaults depend on tier. A free or personal plan often runs more permissive settings than the business plan, so confirm which one your team uses before assuming enterprise terms apply. Ask the vendor for the data-processing agreement in writing, and have it name the subprocessors that touch your data and the regions where it is stored.

Provider terms only cover what happens after data reaches the provider, and they say nothing about what your own staff paste into it in the first place. So build the boundary yourself. Give each AI tool access only to the folders, tables and mailboxes it needs, instead of a blanket connection to every database and file store the business owns.

Where full records are not needed, mask sensitive fields before the AI step, such as card details in an order history or a password pasted into a support ticket. Secrets need their own rule. Passwords, API keys and access tokens must stay out of every prompt and every document the tool can read, exactly as you would restrict a new employee’s first-week access.

Logs deserve the same care. Prompts, uploaded files and model replies are often stored in the tool’s history, so decide who can read that history and how long it is kept inside your account.

Test two failure modes before go-live. The first is whether a crafted input, known as prompt injection, can talk the system into ignoring its own restrictions and revealing information it should not. The second is whether its tool access lets it act beyond its brief, such as reading a file outside its scope or querying a table nobody meant to expose.

For the diagnostics lab, that means trying to coax patient results out of the assistant and then opening the database to see which tables its account can really read. Paper permissions prove nothing.

Write the results down. Record each attempt, the response it produced and the permission or setting that was changed afterwards, so the same test can be repeated after every model update or connection.

Protection does not end at go-live. Review means reading a sample of real prompts and replies every month, looking for pasted secrets and answers that reveal more than the asker should see. Name one person who does that reading, another who answers for a leak, and a written process for deletion requests that reach the AI provider in your chain.

General advice has limits here. Health records carry different obligations from retail records, so treat this article as a starting checklist, not a substitute for a compliance review of your own data.

Deletion is the hard part. When a customer asks for erasure, you must know which copies sit with the provider, in exported logs and in staff mailboxes, and who can remove each.