Identify what the input contains
Look beyond the filename. A spreadsheet may contain customer identifiers, employee information or confidential commercial terms in hidden columns, comments or supporting sheets. Consider whether the entire file is needed. Employees should understand the organisation’s information categories and know whom to ask when they cannot confidently classify the material.
Check the approved use, not just the tool’s name
Permission to use a product for one task does not necessarily cover every data type or account configuration. Follow internal guidance on tools, accounts, sharing and permitted material. Avoid assuming that a personal account has the same controls as an organisation-approved arrangement. Where the answer is unclear, stop and seek the responsible team’s advice.
Reduce unnecessary information and review outputs
Use only the information needed for the task within approved arrangements. Removing a name alone may not make a record anonymous if other details still identify the person. Review output for inaccurate statements, sensitive content and material that should not be redistributed. Information decisions apply to the response as well as the original upload.
Establish a clear escalation route
Tell employees how to report a mistaken upload or suspected exposure promptly under the organisation’s process. The training objective is early recognition and responsible action, not a promise that a short workshop establishes legal compliance. Malaysia’s personal data protection principles and NIST’s generative AI risk guidance are useful references alongside advice from the organisation’s privacy and security owners.
Worked example: A summary request contains more than meeting notes
In a fictional exercise, an employee prepares to upload a meeting pack containing a staff list and a confidential pricing appendix. The approved task only needs a general agenda summary. The employee checks the internal policy and uses permitted material rather than assuming that every attachment belongs in the prompt. The scenario tests recognition and escalation, not a technical guarantee of anonymity.
Put it into practice
- Inspect the actual content before uploading.
- Confirm the permitted tool, account and use.
- Avoid unnecessary personal or confidential information.
- Report mistakes through the established process.