How to stop employees sharing sensitive data with AI tools, not just ChatGPT

Stopping employees sharing sensitive data with AI takes three layers working together: a short written policy, approved business accounts for the tools staff actually use, and a check at the point data leaves the PC. That check must cover pastes and file uploads, on every AI site, not only ChatGPT. Bans on their own tend to fail. Use simply moves to personal phones, where you can see nothing.

Why a ban pushes AI onto phones

AI tools save real time. Summarising a long email. Tidying a spreadsheet. Drafting a letter. Staff who have found that do not stop because a site is blocked.

A common pattern is this. The office blocks ChatGPT. Someone opens it on their own phone instead. They photograph the screen, or email a file to themselves. The data still goes to an AI tool. Now it goes from a device you do not manage, on an account you do not control.

So a ban can make things worse. You lose sight of the use without stopping it. We covered this in more depth in stopping staff pasting client data into ChatGPT without banning AI. The same logic applies to every tool.

Every route data takes into AI

Most firms think about one route: someone pastes text into ChatGPT. There are more.

• Pasting text. A client email, a payroll extract, a contract clause.
• Typing it in. Names and figures written straight into the message.
• Uploading files. Excel, Word, PowerPoint, PDF and text files. One spreadsheet can hold hundreds of clients.
• Other tools. Copilot, Gemini, Claude, Perplexity, DeepSeek and newer sites staff find themselves.
• Other devices. Personal phones and home laptops.

A control that only watches pastes into ChatGPT misses most of that list. Uploads matter most. Priya at Ashcombe uploads a client list to ask for a tidy-up. That one file holds every name, email and phone number. A paste would rarely carry so much.

Controls for each AI tool

Each big AI provider offers business plans with better data terms. Those terms help. They do not stop a person sharing what they should not.

Microsoft Copilot

Copilot comes in several forms. The version tied to a Microsoft 365 business account works under your organisation's settings. The free consumer version does not. Check which one staff are signed into. Our guide on whether Copilot is safe for client data walks through the checks.

Gemini, Claude and Perplexity

Each has free personal accounts and paid business options. The data terms differ between them. Decide which, if any, you approve. Then make sure staff use the business account, not a personal login.

DeepSeek and unapproved tools

Some tools you may not want used at all. Block those. Then find out what else is in use. Staff often try new sites before anyone notices. Here is how to find out which AI tools your staff are using.

Choosing controls that cover the gaps

Work through these in order.

1. Write a short AI policy. One page. Which tools are approved. What must never go in. Get each person's dated agreement.
2. Approve tools and accounts. Pick the tools you allow. Use business accounts with clear data terms.
3. Block what you do not allow. At the browser or the network.
4. Check pastes and uploads. Before anything is sent. On every listed AI site, not one.
5. Train the people who need it. Short and practical. Focus on those who keep tripping the rules.
6. Keep a record. Clients, insurers and auditors increasingly ask what controls you have.

Step four is where most firms have nothing. Policies and training rely on people remembering. A check at the moment of sending does not.

What a good check does

A good check looks at the text or file before it reaches the AI site. It spots card numbers, bank details, National Insurance and NHS numbers, passwords and lists of people. Then it acts. It can take the item out, warn the person, stop the send or just record it.

The best checks do not simply block. They swap the sensitive item for a label. The question still goes through. The person gets their answer. The data stays out.

How Helio Guard does it

This is our product, so read with that in mind. Helio Guard adds a browser extension to Chrome and Edge on each Windows PC. It checks every paste, sent message and file upload on listed AI sites. That includes ChatGPT, Copilot, Gemini, Claude, Perplexity and DeepSeek.

Checks run on the PC with fixed rules, not an AI model. So the text never leaves the computer. We never see what your team types. Only a short record reaches your account: the kind of data, the site, the person, the outcome and the time.

You can add your client list. Real names are swapped for a stand-in such as "Client A". When the answer is copied back, the real names return.

It also records each person's agreement to your AI policy. It flags unapproved AI tools and staff who need training. And it produces a monthly record for clients, insurers or auditors.

Where it falls short

It works on Windows PCs, in Chrome and Edge. It does not cover personal phones or devices you do not manage. A policy and approved accounts still matter for those. You can see Helio Guard pricing if it suits your firm.

Common questions about staff and AI data

Do business AI plans stop staff sharing sensitive data?

Business AI plans improve the data terms, for example how long data is kept and whether it trains models. They do not stop an employee pasting or uploading sensitive data in the first place. A business plan is one layer. A policy and a check before sending cover what the plan cannot.

Should we block AI tools on work computers?

Blocking AI tools you have not approved is sensible. Blocking all AI tools usually pushes staff onto personal phones, where the firm sees nothing. A better approach is to approve a few tools on business accounts, block the rest, and check what goes into the approved ones.

Are file uploads riskier than pasting into AI?

File uploads often carry far more data than a paste. One spreadsheet or PDF can hold a whole client list, payroll or bank details. Any control for AI tools should check Excel, Word, PowerPoint, PDF and text uploads, not only typed or pasted text.

Related: ChatGPT data protection for small businesses: a proportionate guide for 5 to 100 people, AI data loss prevention for small businesses: four options compared on size, setup and cost, UK GDPR and AI tools at work: a plain-English guide to ChatGPT GDPR risk for businesses