How exactly does data leak through AI tools?
Three channels recur in almost every organization. None requires a malicious attacker — a rushed employee, a default setting, or an over-generous integration is enough.
- Employee pastes — a contract, medical report or customer file dropped into a public tool "just to summarize". It is the most common channel, and the reason we wrote what never to paste into ChatGPT.
- Chat history — what was typed is often stored by default in the user's account with the vendor; an account compromise, a shared conversation link or a vendor-side bug exposes all of it.
- Training use — with some tools, under some conditions, conversation content may be used to improve models — depending on the vendor's policy and the user's settings.
- Over-permissioned assistants — an AI assistant wired to email, drives or a CRM with broad access becomes a potential pipe between everything it can see and anyone who manages to query it.
- Shadow AI — tools employees adopt on their own, with no agreement, no review and no oversight.
How do you prevent AI data leaks?
Blanket bans on AI tools almost always fail — employees switch to personal phones, and the organization loses both the benefit and the visibility. The approach that works: allow the tools, and clean what goes into them.
- A clear policy — which tools are approved, for which tasks, and what must never reach them; the foundation of safe AI adoption.
- Anonymize before submission — a document with identifiers replaced by consistent tokens can go into any tool; this is data minimization applied directly.
- Least-privilege access — AI assistants get access only to what their task requires, not the whole mailbox.
- Disable history and training where offered — and prefer business tiers with written commitments.
- Train employees — the innocent paste is the main channel; untrained people will paste.
What does GDPR require once data has leaked?
GDPR Article 33 requires the controller to notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it — unless the breach is unlikely to risk individuals' rights. Where the risk is high, Article 34 also requires informing the affected individuals. Feeding personal data into an unauthorized external tool can constitute such a breach.
- Stop the leak: disconnect the integration, delete the conversation, rotate passwords and permissions.
- Document: what was submitted, to which tool, when, by whom, and which personal data it contained.
- Assess risk: scope, sensitivity and number of affected individuals — and whether notification is required.
- Notify the supervisory authority within 72 hours where required, and affected individuals where the risk is high.
- Fix the root cause: update policy, permissions and training — and deploy a cleaning step before submission.