To keep company data safe when your team uses AI tools, agree on three things: which tools are approved, which kinds of data may go into them, and what to do when someone makes a mistake. Then remove names and identifiers before pasting anything, and treat customer personal data as off-limits unless the business has approved that use.

This article gives you eight rules you can adapt into a one-page team policy, and a high-level note on India’s Digital Personal Data Protection Act, 2023. It is practical guidance, not legal advice. For decisions about your specific obligations, speak to your legal or compliance adviser.

Why is this a problem now?

Because AI assistants are easy to open in a browser, and people paste in whatever helps them finish the task. Without clear rules, that can include customer details, contracts or internal figures.

When there is no rule, people have to guess where the line is. A short, clear policy removes the guessing.

What are the eight rules for safe AI use in a team?

Start with these and adjust them to your business. Keep the final version to one page, so people actually read it.

  1. Sort your data into three groups. Public: already published, such as your website copy. Internal: fine to share inside the company, such as meeting notes without customer details. Restricted: customer and employee personal data, financials, contracts, passwords, source code and anything under a confidentiality agreement.
  2. Use approved tools only. Decide which AI tools the team may use for work, and say so in writing. If a tool is not on the list, people should ask before using it with company material.
  3. Use company accounts, not personal ones. Work should happen in accounts the business controls, so access can be managed and removed when someone leaves.
  4. Keep restricted data out unless it is approved. Restricted data goes into an AI tool only when the business has checked the tool, its settings and the agreement with its provider, and has approved that specific use.
  5. Remove identifiers before you paste. Replace names with roles (“the customer”, “Vendor B”), and remove phone numbers, email addresses, account numbers, Aadhaar or PAN numbers and addresses. For drafting and summarising, the tool rarely needs the real details.
  6. Check the tool’s data settings. Many AI tools have settings about chat history and how your inputs may be used. These differ between products and change over time, so have one person check them for each approved tool and record the decision.
  7. A human checks before anything goes out. AI output that reaches a customer, a regulator or the public is reviewed by a person who is accountable for it. My routine for this is in Checking AI output before you send it.
  8. Report mistakes fast, without blame. If someone pastes restricted data into the wrong tool, they should tell a named person immediately. Agree who that person is and what happens next.

What does India’s DPDP Act, 2023 say about this?

The Digital Personal Data Protection Act, 2023 governs how organisations process digital personal data in India. Among other duties, once in force, it requires them to take reasonable security safeguards to prevent a personal data breach, including when someone else processes the data on their behalf.

A few points from the text of the Act published in the Gazette of India, kept deliberately high level:

  • Personal data means any data about an individual who is identifiable by or in relation to that data (section 2(t)).
  • A Data Fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data (section 2(i)). In most businesses, that is the company.
  • A Data Fiduciary must protect personal data in its possession or control, including processing done on its behalf by a Data Processor, “by taking reasonable security safeguards to prevent personal data breach” (section 8(5)).
  • If there is a personal data breach, the Data Fiduciary must inform the Data Protection Board and each affected person, in the manner prescribed (section 8(6)).
  • A Data Fiduciary may use a Data Processor to process personal data on its behalf only under a valid contract (section 8(2)).

The Act is coming into force in phases. The Ministry of Electronics and Information Technology issued a commencement notification dated 13 November 2025. Under it, some provisions came into force on publication, and most of the duties on organisations, including section 8, come into force eighteen months after publication. The Digital Personal Data Protection Rules, 2025 were notified in November 2025.

What this means for a team using AI: before customer or employee personal data goes into any AI tool, the business should know whether that is allowed, under what agreement, and with what safeguards. That is a decision for the business and its advisers, not for an individual employee in the middle of a task.

How do you remove identifiers without losing the useful part?

Replace each identifier with a consistent label, and keep a private key on your own machine if you need to map it back. The AI tool only needs the shape of the problem, not the real names.

For example, a complaint summary does not need the customer’s name, phone number or order ID to be summarised well. “Customer A reported a delayed delivery and asked for a refund” works just as well for drafting a reply. You add the real details back when you send it, from your own system.

Try it: Take a recent internal email that mentions a customer. Rewrite it with every identifier replaced by a label. Read it again: could an AI tool still help you draft a reply?

How do you roll the rules out to a team?

Keep it short, explain the reasons, and show examples. A rule people understand is a rule people follow.

A simple rollout:

  1. Write the one-page policy. Use the eight rules above, with your approved tool list and your named contact for mistakes.
  2. Walk the team through it. Use real examples from your own work: what is fine to paste, what needs anonymising, what never goes in.
  3. Make the approved tools easy to reach. If the approved option is slower than a personal account, people will drift back.
  4. Review it regularly. Tools, settings and the law change. Put a review date on the policy.

What should you do when someone makes a mistake?

Act quickly and calmly. Find out what was shared, with which tool and on which account, and follow your internal incident process.

If personal data may have been exposed, involve whoever handles data protection in your organisation straight away, because the Act has requirements for informing the Data Protection Board and affected people about a personal data breach. Do not try to judge that alone.

Then fix the cause. Look for a missing rule, an unclear example or an approved tool that is too hard to use.

What to do next

Draft your one-page policy this week using the eight rules, and share it with your team. If you would like help training a team to use AI tools safely and well, see the path for teams on the learn page.