What are five things you should never tell ChatGPT?

Published 11 November 2026 / Hutch Media Group

The five things to keep out of ChatGPT, and tools like it, are customer or staff personal data, confidential business information, anything covered by an agreement with someone else, passwords and payment details, and anything you'd regret seeing made public. The common thread is that what you type goes to a company you don't control.

That doesn't mean you can't use AI at work. It means choosing what goes in. The UK's National Cyber Security Centre (NCSC) puts it simply: don't put sensitive information into public AI tools, and don't ask anything that would cause problems if it became public. The difficulty is that people rarely stop to think before pasting something in, especially when they're busy.

What happens to what you type into ChatGPT?

What you type is visible to the company running the tool. The NCSC explains that queries are stored, can be read by the provider and its partners, and will almost certainly be used to develop the service at some point. The same post says an AI model doesn't automatically add your question to its knowledge for other people to pull out. That was written in 2023, so check the terms of whatever tool you use.

A more recent NCSC post on shadow AI says information entered into consumer AI services may be stored, retained or used to improve the service unless specific privacy controls are in place. So the plan you're on, and the settings you've chosen, make a real difference.

What are the five things you should never tell ChatGPT?

1. Personal data about customers or staff. Names, contact details, health information, complaints, CVs and HR issues all count. If you want to use AI on this kind of information, use a business version of a tool with proper data terms, and read our guide on whether using AI breaches GDPR.
2. Confidential business information. Contracts, pricing you haven't announced, financial figures, plans and customer lists belong inside your own systems, not in a public chat window.
3. Anything covered by an agreement with someone else. If a client has you under a non-disclosure agreement, or has shared documents on the understanding that they stay private, pasting them into an AI tool is not yours to decide.
4. Passwords, access codes and payment details. There is never a good reason to paste a password, an API key or a card number into an AI tool, however convenient it feels.
5. Anything you'd regret being public. The NCSC points out that a question can be sensitive just because of who is asking and when. Its example is a chief executive asking how best to lay off an employee. Queries can also be leaked or exposed by accident, so the test is simple: would this be a problem if it appeared on a screen in front of the wrong person?

What should you do instead?

The simplest rule is to leave identifying details out. Swap a customer's name for "the customer", and describe the situation rather than pasting the email. You still get most of the help and none of the personal data.

• Use a business version of a tool, with proper terms, for anything involving customers or staff.
• Check the privacy settings in whatever you use, including whether your chats can be used to improve the service.
• Keep work and personal AI accounts separate.
• Tell your team in plain language what's fine and what isn't, so nobody has to guess.

The NCSC isn't telling anyone to stop using AI. Its advice is to think about which tools and services you use before you share data. If your staff are already using their own accounts, finding out why is a better start than a ban, because a ban tends to push it out of sight.