A Practical AI Privacy Checklist

Privacy is not a single switch. It depends on the account type, data submitted, retention rules, enabled integrations, people with access, and the purpose of the workflow. Use this checklist before adopting an AI tool for personal or business work.

Account ownership

• Is the account personal or owned by the organization?
• Can access be removed when an employee leaves?
• Is multifactor authentication enabled?
• Who can change billing and security settings?

Data-use controls

• Can prompts or files be used to improve the service?
• Is there a setting to opt out?
• Does the control apply to all users and integrations?
• Are business and consumer terms different?

Retention and deletion

• How long are chats, files, logs, and deleted items retained?
• Can administrators set a retention period?
• Does deleting a conversation delete uploaded files?
• Can the account and its data be exported or erased?

Sharing and collaboration

• Can chats or projects be shared by public link?
• Can shared links be revoked?
• Are files visible to an entire workspace?
• Can external guests access content?

Connectors and integrations

A connector may give the AI access to email, calendars, cloud drives, code repositories, or business systems. Review the requested permissions, data scope, administrator approval, and revocation process. Disable unused connectors.

Content submitted

• Are names, IDs, contact details, or confidential facts necessary?
• Can placeholders or synthetic examples be used?
• Does the file contain metadata, comments, or hidden content?
• Is the task allowed by policy, contract, and law?

Output handling

Generated output can repeat sensitive details from the prompt. Decide where responses may be copied, stored, or shared. Do not publish generated text without checking whether it reveals private information.

Workplace governance

Document approved tools, account types, prohibited data, review responsibilities, incident reporting, and vendor assessment. Train employees with examples instead of relying on a vague instruction to “be careful.”

Review schedule

Recheck settings after major product updates, plan changes, new connectors, staff changes, or policy revisions. Record the date, account type, and person responsible for the review.