Data privacy with AI

The idea

Anything pasted into a public AI tool leaves your office. You may not know where it is stored, who sees it, or whether it trains the tool. So keep the never-paste list: a short list of things that never go into a public AI tool, pinned where every staff member can see it. Most AI work can be done perfectly well without them.

The never-paste list

Print it near the office computer. Teach it on a new staff member's first day.

At the counter

The clerk wants help writing reminder messages to 30 retailers with overdue bills. The quick way is to paste the outstanding report — names, phone numbers, amounts — into a public AI tool and ask for 30 messages.

The safe way takes two minutes more:

1. Ask the AI for one reminder template: "Polite Tamil reminder to a kirana owner. Use [NAME], [AMOUNT], [DAYS] as blanks."
2. Fill the blanks in the business software, which already holds the names and amounts, or by hand.

Same 30 messages; nothing left the office. The trick works almost everywhere: write "Shop A, Shop B" for names, round the amounts, ask about the pattern, not the person.

AI built into your own business software is different — the data is already there, under an agreement with the vendor. Still ask the vendor in writing where it is processed, whether it trains anything, and who can see it (chapter 4.9).

The DPDP Act in plain words

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) protects personal data — anything that identifies a living person: a name with a phone number, an Aadhaar number, a salary, a photo. A sole-proprietor retailer's mobile number is personal data. So is your salesman's bank account.

The principle is simple. If your business holds someone's personal data:

• Collect it for a clear purpose, and tell the person what it is for.
• Use it only for that purpose. A retailer's number given for delivery is not for sharing with a stranger, or a tool you don't control.
• Keep it safe, and keep it only as long as you need it.
• Respond if the person asks to see, correct or remove it.
• You stay responsible even when someone else — a software vendor, an AI service — handles it for you.

The Act provides for penalties, and its rules come into force in stages. For the current rules and dates, check the official government notification or ask your auditor. The safe habit doesn't depend on the date: don't send people's data where you can't say who will see it.

Common mistake

Pasting a staff payroll sheet into a public AI tool "just to calculate the incentives faster". Now every salesman's salary, bank account and PF number sits on a server you know nothing about. If it leaks, the damage lands on people who trusted you, and on you. Calculate incentives in the payroll software (chapter 4.7).

Where you'll use this

This is the rule from chapter 4.11 — keeping data safe — carried one step further. Roles and passwords decide who inside the office can see the data; the never-paste list decides what leaves it.

Check yourself

1. Name four items on the never-paste list.
2. How can you get AI to help write 30 payment reminders without pasting any retailer's details?
3. Is a sole-proprietor retailer's mobile number personal data under the DPDP Act?

Answers

1. Any four rows of the table above.
2. Ask for one template with blanks for name, amount and days, then fill the blanks in your own software.
3. Yes. It identifies a living person.