ChatGPT, Copilot & Company Data: What Employees Should Never Share.
A practical data-handling guide for SMEs using generative AI — including the difference between personal accounts, managed business AI and Microsoft Copilot.
Do not treat every AI account as if it has the same protections. Business and enterprise products can have materially different privacy, retention, admin and training terms from personal accounts. Even when a business product says prompts are not used to train foundation models, employees still need rules about what data is appropriate to disclose, who is authorised to use the service and whether the output can be trusted.
The core rule: approved tool, approved data, approved purpose
The safest employee rule is not “never put company data into AI”. That is too simplistic — many business AI products are specifically designed to work with company information. The better rule is: only use approved AI services, for approved business purposes, with information you are authorised to share with that service.
OpenAI states that content from ChatGPT Business, Enterprise and its API is not used to train its models by default. Microsoft says prompts, responses and organisational data accessed by Microsoft Copilot are not used to train foundation models. Those protections are useful, but they do not remove the need for internal data rules. OpenAI business data controls ↗ Microsoft Copilot privacy ↗
Information employees should not share without explicit approval
The exact policy should reflect your business, but these categories deserve a high bar. If the use case genuinely requires them, the organisation should first confirm the platform, contract, access controls, purpose and legal basis.
Personal AI accounts vs managed business AI
This distinction is one of the easiest things for SMEs to miss. An employee may use the same brand at home and at work, but the account type, contract and administrator controls can be completely different.
Personal ChatGPT, Copilot or another consumer AI account
The organisation may have no admin visibility, no central retention policy, no contractual control and limited ability to investigate or remove company data later.
Do not assume a consumer account inherits the privacy commitments of an enterprise or managed business workspace.Approved managed business workspace
The business can evaluate contractual terms, identity controls, data handling, logging, retention and available security features before allowing employees to use it.
Managed does not mean risk-free. Permissions, prompts, connected data and user behaviour still need governance.Why Microsoft Copilot makes permissions more important
Microsoft Copilot can use Microsoft Graph and the organisational data a user already has permission to access. That is powerful, but it can expose an old problem very quickly: information that was technically accessible but difficult to find becomes easier to surface through natural-language prompts.
Microsoft explicitly recommends using the permission models in Microsoft 365 to ensure users and groups have the right access. Before a broad Copilot rollout, review SharePoint sharing, stale groups, external access and sensitive content rather than assuming AI itself will fix those controls. Microsoft data, privacy & security ↗
Seven employee rules that are easy to follow
Do not move company information into personal AI accounts simply because the interface looks familiar.
Passwords, tokens, API keys, recovery codes and encryption keys belong in dedicated secret-management systems.
Give the AI only what it needs. Remove names, identifiers and irrelevant detail where the task can be completed without them.
If a file is confidential, customer-restricted or legally sensitive, stop and confirm whether the approved AI service may process it.
Verify facts, numbers, citations, legal language, customer commitments and anything that could materially affect a decision.
A browser extension, personal API key or copy-and-paste workaround can turn an approved workflow into an unapproved one.
Employees need a clear route to IT, security or a business owner rather than guessing whether a new tool or data type is acceptable.
Data minimisation still applies
If personal information is involved, the ICO's data-minimisation principle remains relevant: personal data should be adequate, relevant and limited to what is necessary for the purpose. AI does not create an exception to that rule. ICO data-minimisation guidance ↗
Before sharing business data with an AI tool, ask:
This is a useful 30-second check for employees and managers.
The bottom line
The goal is not to frighten employees away from AI. It is to give them a safe route to use it. A business that provides approved tools and clear data rules will usually get better adoption than one that simply says “do not use AI” and leaves employees to solve the problem themselves.
Check product protections before trusting assumptions.
These official sources explain how leading business AI services handle prompts, organisational data and privacy, alongside UK data-protection guidance.
External links open official third-party websites in a new tab. CloudSec AI does not control those sites and this article is practical technology and governance guidance rather than legal advice.
Give your team AI tools without losing control of data.
We can review your current AI use, Microsoft 365 permissions and data-handling risks, then put practical controls and employee guidance around the tools you want to enable.
Start a conversation ↗