Guides · Updated October 4, 2026
What information should employees never put into AI tools?
The short answer
Unless a tool has been approved for it, employees should keep out personal information about customers and employees, confidential business information, anything covered by a confidentiality agreement, sensitive information such as health or financial account details, and passwords or access details. A simple rule: if you would not email it to a stranger at another company, do not paste it into a tool the company has not approved.
The categories, with examples
- Personal information: names with contact details, Social Insurance Numbers, dates of birth, home addresses, pay, performance reviews, medical or leave records.
- Customer and client information: account details, files a client shared with you, anything under a nondisclosure agreement.
- Confidential business information: pricing, margins, financial results, bids, strategy, legal matters.
- Sensitive information: personal health information held by a health care provider, payment card numbers, bank account numbers.
- Security details: passwords, access keys, network and system configuration.
Why it matters even when nothing seems to happen
Once information is entered into a tool, the company no longer controls it. Depending on the provider’s terms and the account settings, it may be kept, reviewed by the provider’s staff, or used to train future models. A confidentiality agreement with a client may already treat that as a breach, and Canada’s privacy regulators expect organizations to limit the personal information they put into generative AI.
An approved tool changes some of the answer
A business account with training switched off and a contract with the provider can make some internal information acceptable. The policy should say exactly which categories are allowed in which approved tool. Personal and sensitive information usually stays out even then, unless the tool was set up and contracted for it.
Sources
This guide is general information for employers in Canada, not legal advice. Standard Practice is not a law firm. Laws change and depend on the province where your employees work; take advice from an employment lawyer on your own situation.