Data Privacy in Practice

In Week 1 you learned the basic "don't paste this" list. This lesson goes further: what AI providers can do with your inputs, how plan types differ, what Indian law now expects, and how to anonymise so you can still get real work done.

Provider data policies change. Always check the current privacy settings and terms for the specific plan you use — the AI Tool Radar (/tools) links to them.

---

1. What can happen to what you type

Depending on the provider and your settings, your inputs and uploads may be:

• Used to train future models — on many consumer plans by default, unless you turn it off.
• Reviewed by humans — for safety, abuse detection or quality, sometimes even when training is off.
• Retained for a period (often 30 days or more) for abuse monitoring, even after you delete a chat.
• Processed by sub-processors — cloud hosts and other vendors listed in the provider's terms.
• Shared inside a workspace — custom GPTs, projects and connected apps can expose files to colleagues.

2. Plan tiers and what they typically mean

Plan type	Training on your data	Contract / data agreement	Admin controls
Free consumer	Often on by default; opt-out usually available in settings	Standard terms only	None
Paid individual (Plus, Pro etc.)	Usually still controlled by your personal setting	Standard terms only	None
Business / Team / Enterprise	Typically off by default	Data Processing Agreement (DPA), security certifications (e.g. SOC 2)	SSO, retention, audit logs
API	Typically not used for training by default	API terms, DPA available	Via your own system

The key point: a paid personal subscription doesn't automatically make work data safe. For company or client data, the usual answer is a business/enterprise plan your organisation has approved — and even then, read the DPA for retention and human review.

3. The legal landscape, briefly

• India — DPDP Act 2023 and DPDP Rules 2025. The Rules were notified in November 2025 with a phased rollout: the Data Protection Board first, consent-manager provisions from November 2026, and most substantive obligations — notice, consent, security safeguards, breach reporting, data principal rights — by May 2027. If you process personal data of people in India for your business, you're a data fiduciary with duties about purpose, consent, security and breach notification. Children's data has extra restrictions.
• EU — GDPR, if you offer services to people in the EU, plus the EU AI Act's obligations phasing in for AI systems.
• US — sector laws (e.g. HIPAA for health) and state privacy laws (e.g. California's CCPA/CPRA).
• Contracts — client NDAs and engagement terms often restrict sharing data with third parties, which includes AI providers.

Your responsibility: if you put someone's personal data into an AI tool as part of your work, you (or your employer) may be accountable for that choice.

4. Your red zone

Never enter these into an AI tool unless it's specifically approved for that data class:

• Identity documents & numbers: Aadhaar, PAN, passport, voter ID
• Credentials: passwords, API keys, OTPs, recovery codes
• Financial data: account and card numbers, bank statements, salary slips
• Health data: diagnoses, prescriptions, reports linked to a person
• Customer & employee records: names with contact details and history
• Confidential business information: unreleased financials, deal terms, source code under NDA, legal strategy
• Anything marked confidential, or covered by a client agreement

5. Anonymise so the task still works

Most tasks need the pattern, not the identity.

Replace	With
Names	Roles or codes: Client A, Employee 2, Vendor X
Exact amounts	Ranges or indexed values: ₹10–20 lakh, or "base = 100"
Dates	Relative: last quarter, month 3
Locations	Region level: a tier-2 city in the west
Unique details	Remove if not essential: rare job titles, specific incidents

Watch for re-identification by combination: "the only woman CFO of a listed Pune pharma company" is identifiable without a name.

Also remove hidden data: document metadata (author, company), tracked changes and comments in Word files, EXIF location in photos, and names in file names.

Test: could someone who knows the context identify the person or company from what I pasted? If yes, anonymise further or don't use AI for it.

6. The ten-minute privacy audit

1. Settings: in every AI tool you use, find the data controls. Turn off training on your data where you want to, and note what the setting actually says.
2. Connected apps: review which tools have access to your email, drive and calendar. Remove what you don't use.
3. History: delete old chats containing sensitive material (knowing retention periods may still apply).
4. Shared GPTs/projects: check who can see the files you uploaded.
5. Workplace: confirm which tools are approved for which data, and write it down.

---

⚠️ Common mistakes

• Assuming "paid" means "private". Check the plan type and settings.
• Assuming "enterprise" means nothing is retained. Read the DPA.
• Forgetting metadata and tracked changes in uploads.
• Partial anonymisation that's still identifiable by combination.
• Connecting AI tools to everything "just in case".

---

What's next: privacy is about what you share. Ethics is about what you do with what AI produces.