Nobody Types Personal Data on Purpose — Where It Hides
The signature, the quoted reply, a form, a spreadsheet, a log. Five places personal data travels into an AI chat when nobody meant to send it, and why the useful question is whether a detail is needed rather than whether it looks personal.
On this page
Personal data reaches an AI chat mostly when nobody set out to send it.
You paste an email to get it summarised, a paragraph to get it tidied up, an error to get it explained. A name, an email address, a phone number comes along with the part you wanted help with.
What gets missed is rarely the part you wanted the AI to read. It is whatever is attached around it.
Five places personal data travels in
1. The email signature
You meant to send the body. Sitting under it is a block with a name, a company, a department, a phone number and an address.
If all you want is better wording, the signature is almost never part of the question.
2. The reply you quoted
Copy a message straight out of the client and you often take the thread with it — not only what you wrote, but what came before.
That older part carries the other person's name and address, and sometimes a third colleague's.
Cutting out only the part you are asking about already removes most of it.
3. Forms and order details
"Make this easier to read" is a fair request to make of an enquiry or an order confirmation. Those documents carry a name, an address, a phone number, an order reference.
For a rewrite, placeholders usually keep the meaning intact.
- "Jane Doe" → "Customer A"
- "+1 555-0100" → "[phone]"
4. Tables and CSVs
Spreadsheets deserve a second look.
The columns you care about may be amounts and categories, while the ones beside them still hold names, addresses and customer numbers.
If the question is how to aggregate the data, a made-up table usually answers it just as well.
| Age band | Product | Amount |
|---|---|---|
| 40s | Product A | 3,000 |
5. Logs and copied error output
A log — or a block copied straight off the screen — carries its own payload: usernames, email addresses, file paths, internal URLs, identifiers.
Diagnosing the error rarely depends on those exact values. Replacing user@example.com with [email] keeps the shape of the log while dropping the part that identifies someone.
Not "strip anything personal" — ask whether it is needed
The goal is not to delete every string that looks like personal data. The question I start from is whether the AI needs it to answer.
For a rewrite, real names are almost never needed. For a question about aggregation, real customer rows are probably not needed either. For a question about how to format an address, the shape of the address is the whole point — though an invented address still does the job.
When it is not needed, three moves cover most of it.
- delete it
- replace it with a placeholder such as "Customer A"
- swap the real data for an invented example
Check the edges last
Re-reading a long document word by word before every paste is not realistic. What is realistic is looking at the top, the bottom, the quoted section and the columns beside the ones you care about.
That is where the details you had no reason to send tend to sit: the salutation, the signature, the older reply, the spare column, the identifier in a log. In my case, what I notice afterwards is always at an edge.
What happens to the text after it goes depends on the service, the contract and the settings. Japan's Personal Information Protection Commission puts a related point to users: read the provider's terms of use and privacy policy carefully, and decide about using the service in light of what you are about to enter.
At work there is an earlier step — your employer's rules and the contracts you are under. Where that line falls for business documents is the subject of four places I check before pasting work documents into an AI chat.
Safe Privacy Gate is the tool I built for that last look before sending. It puts what it found on screen; it does not decide for you whether the text is fine to send.
More detail
The commission's document (published 2 June 2023) is in three parts: businesses handling personal data, public bodies, and general users. The third part, the one referred to above, lists three points for users.
- personal data entered into a generative AI service may be used for machine learning, and may be output — linked statistically to other information, and accurately or inaccurately
- a response may itself contain inaccurate personal data
- read the provider's terms of use and privacy policy carefully, and judge the use of the service in light of what is being entered
For work, the part addressed to businesses matters more. Entering a prompt containing personal data without the person's consent, where that data is then handled for purposes beyond producing the response, may breach Japan's Act on the Protection of Personal Information.
The document dates from 2023, and the commission notes that it may issue further alerts. Rules elsewhere differ; this one is the Japanese position.
References
- Personal Information Protection Commission, "生成AIサービスの利用に関する注意喚起等について" (published 2 June 2023, Japanese, external site) — points for general users, and notes for businesses handling personal data
Read on 12 September 2026, from the PDF of the published document.