There are some things you should never tell ChatGPT, especially when they involve sensitive personal, financial or confidential information. ChatGPT can help you draft emails, analyse information, summarise documents, brainstorm campaign ideas and work through everyday tasks, but its convenience can also make it easy to paste information without first checking what is contained in it.
Imagine asking ChatGPT to improve an email from a customer and pasting the entire thread, including their phone number, account details and previous correspondence. A colleague might upload an internal strategy document because they want a quick summary, while someone else may paste a spreadsheet containing client information because they need help analysing it.
The AI task itself may be perfectly reasonable. The information being shared deserves more thought.
Knowing how to use generative AI effectively therefore involves more than learning how to write good prompts. AI literacy also includes knowing what information is appropriate to share, what should be removed and when your organisation’s data policies need to guide your decision.
In this guide, we look at five things you should never tell ChatGPT in an ordinary AI conversation, why they require extra care and what you can do instead.
1. Passwords, PINs and login credentials
Passwords should remain in secure credential-management systems rather than being entered into an AI conversation. The same applies to PINs, one-time passwords, recovery codes, security-question answers, authentication tokens, private keys and other information that provides access to an account.
Sometimes this information can be shared accidentally rather than intentionally. For example, someone troubleshooting a technical problem may paste a configuration file containing an API key. An employee asking for help with an error message may copy information from a system without noticing that a credential appears within it.
Before sharing code, screenshots, technical logs or configuration files with an AI tool, review them for sensitive credentials. Where the example requires a password or API key for context, replace the actual value with a placeholder such as [PASSWORD] or [API_KEY].
The AI can usually help you understand the problem without receiving the real credential.
This is a useful digital-security habit beyond ChatGPT as well. Information that gives someone access to your email, company systems, financial accounts or other services should be handled separately from information you share for analysis or troubleshooting.
2. Bank account details and other financial credentials
You can use ChatGPT to understand budgeting concepts, organise financial information or explain unfamiliar financial terminology. That does not require giving the tool credentials that could be used to access your money.
Bank account login details, credit or debit card numbers, PINs, mobile-money credentials, recovery information and similar financial access data should be kept out of ordinary AI prompts.
A common risk comes from documents rather than typed questions. You might upload an invoice because you want help improving its wording, or a financial statement because you want assistance categorising expenditure. Those files may contain account numbers, addresses and other details that the AI does not actually need for the task.
A better approach is to remove or mask unnecessary identifiers before sharing the document. For example, you can replace an account number with [ACCOUNT NUMBER], remove customer names from financial data or create a sample version of an invoice containing fictional details.
The principle is straightforward: give the AI the information required to understand the task rather than information that could be used to access your financial accounts.
3. Government IDs and unnecessary personally identifiable information
Personally identifiable information can include passport numbers, national identification details, driving licence numbers, full dates of birth, home addresses and other information that can be linked directly to an individual.
The challenge is that this information is often embedded in documents.
Suppose you want ChatGPT to improve your CV. The tool may need to see your experience, qualifications and skills, while your full home address, identification number or other highly specific personal details may add no value to the task.
The same issue becomes even more important when working with information belonging to other people. A marketer analysing customer feedback, an NGO reviewing beneficiary data or a trainer working with participant information may have access to names, email addresses, telephone numbers or identification details.
Before sharing that information with an AI tool, ask what is actually required for the task. Often, the analysis can still be performed after personal identifiers have been removed or replaced with anonymous labels such as Participant A, Customer 01 or Respondent 15.
This is an example of data minimisation: sharing only the information required to achieve the intended purpose.
4. Confidential business, employee and client information
This is one of the most important areas for organisations adopting generative AI.
Imagine someone preparing for a strategy meeting and uploading the organisation’s unpublished five-year plan so that ChatGPT can identify weaknesses. Another employee might paste an entire client brief into an AI tool for help developing campaign ideas, while a communications professional could upload an unpublished crisis-response document for editing.
The intended use of AI may make sense. The way the information is handled still needs to follow the organisation’s confidentiality, security and contractual requirements.
Confidential information may include internal strategy documents, customer databases, employee records, contracts, unpublished financial results, proprietary research, tender documents, client information, unreleased products and material covered by non-disclosure agreements.
For organisations, this is why AI adoption needs governance alongside training.
Employees should know which AI tools have been approved for work, what kinds of organisational information can be shared, what needs to be anonymised and which information requires additional approval.
There is also an important distinction between personal ChatGPT accounts and managed business environments. OpenAI says content from ChatGPT Business, Enterprise and Edu workspaces is not used to train its models by default.
That protection is important, but it does not replace your organisation’s internal policies, contractual obligations or access controls. An employee still needs to consider whether they are authorised to share a particular document and whether the AI system being used has been approved for that type of information.
For many organisations, the useful question is therefore broader than “Can ChatGPT analyse this?”
It is whether the organisation has established an appropriate and approved process for using AI with that information.
5. Unnecessary sensitive health and personal information
Generative AI can be useful for explaining terminology, helping someone understand a complicated document or preparing questions they may want to discuss with a professional.
However, health documents and other sensitive personal records often contain far more information than is required for a particular question.
A medical report, for example, may include a person’s name, patient number, address, telephone number, test results and other identifying information. If the objective is simply to understand a particular term or passage, much of that identifying information may be unnecessary.
Where appropriate, remove identifying details and share only the part of the information required for the task. The same principle applies to other sensitive information involving employees, customers, programme participants or beneficiaries.
The environment in which AI is being used also matters. An organisation using an approved system designed for handling sensitive information may operate under different controls from someone using a personal consumer account.
The practical lesson is that being able to upload an entire document does not automatically mean the entire document is necessary for the task.
Think before you paste, upload or screenshot
One of the simplest habits for safer AI use is to pause before adding information to a prompt.
Consider what ChatGPT actually needs in order to complete the task. A 50-page report may contain only three paragraphs relevant to your question. An email may make sense without the sender’s telephone number and account information. A spreadsheet may still be useful for analysis after customer identifiers have been removed.
The same caution should apply to screenshots.
A screenshot taken to show an error message may also reveal an email address, account number, browser tab, client name or other information in the background. PDFs, presentations and spreadsheets can contain similar information in headers, footers, comments or metadata.
Developing the habit of checking information before sharing it is one of the practical parts of responsible AI use.
Understand ChatGPT’s privacy controls
It is also worth understanding the controls available within ChatGPT rather than assuming that every ChatGPT conversation is handled in exactly the same way.
For eligible personal ChatGPT accounts, users can go to Settings > Data Controls and turn off Improve the model for everyone. OpenAI says new conversations created after opting out will not be used to train its models. OpenAI Help Center
ChatGPT also offers Temporary Chat. While a conversation remains temporary, it stays out of chat history, does not create or update memories and is not used to improve OpenAI’s models. OpenAI says a copy may still be retained for up to 30 days for safety purposes.
For organisational users, OpenAI says data from ChatGPT Business, Enterprise, Edu and several other business offerings is excluded from model training by default.
OpenAI also states that it does not sell user data and does not share ChatGPT conversations with advertisers or marketing partners.
These settings are useful privacy controls, but they work best alongside good information-handling habits. Data minimisation, organisational policies and professional judgement remain important regardless of the technology being used.
AI privacy should become part of workplace AI training
As more employees begin using generative AI at work, organisations need to teach much more than prompting.
Imagine a communications team that has been trained to use AI for research, drafting and summarising reports but has never discussed what information can be uploaded. Employees may become very productive with the technology while making inconsistent decisions about confidential information.
Practical AI training should therefore include data handling.
Teams should understand which AI tools the organisation has approved, which information can be shared, what should be anonymised and which documents require additional care. They also need guidance on customer information, meeting transcripts, internal reports, intellectual property and third-party information.
This gives employees something more useful than a vague instruction to “be careful with AI”.
It provides clear boundaries for using the technology confidently and responsibly.
For organisations adopting generative AI, an internal AI-use policy can support this process. The policy can explain approved tools, permitted use cases, information classifications, review responsibilities and what employees should do when they are uncertain whether a particular document can be shared.
What to do instead of sharing sensitive information
Using AI safely does not mean removing all context from your prompts. Good AI results often depend on good context.
The better approach is to provide relevant context without unnecessary sensitive information.
If you need help rewriting a customer complaint, remove names, phone numbers and account numbers while preserving the substance of the complaint. When analysing survey responses, replace personally identifying information with anonymous identifiers. For a strategy example, provide the relevant scenario while removing confidential commercial details.
You can also create fictional or representative examples when the actual information adds unnecessary risk.
These small changes allow you to benefit from generative AI while maintaining better control over the information you share.
Knowing what not to share is part of AI literacy
ChatGPT can be useful for writing, research, analysis, ideation, learning and everyday productivity. Responsible use means understanding both what the technology can help you accomplish and how the information you provide should be handled.
The five things you should never tell ChatGPT in an ordinary conversation are therefore less about avoiding AI and more about developing better digital habits. Protect access credentials and financial information, minimise personal identifiers, handle confidential organisational information appropriately and think carefully before sharing sensitive records.
Before pasting information into an AI tool, take a moment to ask whether every detail is necessary for the task. Where it is not, remove it, anonymise it or replace it with a placeholder.
Knowing how to prompt ChatGPT is useful. Knowing what belongs in the prompt is part of AI literacy too.
Need AI literacy training for your team?
Samodigital helps organisations and teams build practical capabilities in AI literacy, digital marketing, digital communication and the responsible use of emerging technologies.
Our approach goes beyond showing teams which buttons to click. We help people understand how to apply digital and AI tools within real work while considering accuracy, privacy, professional judgement and responsible use.
Contact us info@samodigitalagency.com
