Most employees encounter more confidential information than they realize — client names in emails, internal project details, colleague information. The training is designed to help all employees recognize when the information they are working with crosses into territory that requires more care before prompting.

GDPR violations — including inadvertent disclosure of personal data to unauthorized processors — can result in regulatory investigation, significant fines, and notification obligations. The fact that the disclosure was unintentional does not eliminate the obligation or the consequence.

Integrated AI tools in enterprise software often have different data handling arrangements than standalone public tools. Your IT or legal team will specify which integrated tools are approved and under what conditions. Do not assume that an AI tool built into approved software automatically handles your data safely — verify with your IT team.

If information is genuinely public — a company press release, a published annual report, publicly available regulatory filings — it can generally be entered into a public AI tool. The rule applies to confidential, internal, or personal data. When in doubt, treat it as confidential.

Platform terms change, and the absence of training-use claims does not guarantee data isolation. Company policy applies regardless of what an individual platform's terms say. For confidential data, use company-approved sandbox tools — not public tools, regardless of their stated data practices.