What you should never paste into an AI chatbot
Treat anything you type into a public AI tool as if it could become public. Some things should never go in at all.
- Passwords, MFA codes, recovery codes and API keys — ever.
- Bank, card or tax file numbers, and any payment details.
- Customers’ or staff members’ personal details: names with contact details, dates of birth, addresses, ID numbers.
- Health information about anyone — it’s sensitive information under the Privacy Act.
- Confidential business material: contracts, pricing, legal advice, board papers, unreleased plans.
- Screenshots or files that contain any of the above. Check what’s visible before you upload.
- Need help with a real case? Swap in made-up names and numbers, and use your business’s approved AI tool.
Based on: OAIC — Privacy and commercially available AI products · Digital Transformation Agency — Staff guidance on public generative AI
Still stuck after those?
You’ve done the right thing by trying. Send whedo.it a quick note — what you tried, what you saw — and a senior pair of eyes will be on it the same business day.