Lesson 5 of 7 · 14 min · Checked on 6 October 2026
What never to paste: data, rights and the law in 5 minutes
By the end of this lesson you will be able to:
- Identify the data you should never paste into an AI assistant
- Remove personal data from a text before asking the AI for help
- Recognise the situations in which AI should not be used
- Explain what European law asks organisations to do about AI literacy
One quick move too many
Sandra works at the front desk of a clinic. To save time, she pastes the day's appointment list into an AI assistant: names, health service numbers (números de utente), the reason for each visit. She asks "organise this by time". It works very well.
But the health data of twenty people has just left the clinic for an outside company, without permission. There was no bad intention, only haste.
The concept: pasting is sending
When you type or paste something into an AI assistant, that text goes to the computers of the company that makes it. It may be stored. Depending on the service and settings, it may be reviewed or used to train future versions.
The simplest rule: only paste what you would write on a postcard, the kind anyone can read along the way.
The list of what never to paste
- Personal data of other people: names with addresses, phone numbers, emails, photos.
- Identification numbers: Citizen Card, tax number (NIF), health service number, IBAN, passport. Yours or other people's.
- Health data: diagnoses, test results, prescriptions, reports.
- Passwords and codes: your bank password, the code that arrives by SMS, the PIN.
- Customer data: lists, contacts, orders, invoices.
- Confidential work documents: contracts, proposals, internal minutes, case files.
Tip
Before pasting, swap the data for labels: "Maria Silva" becomes "customer A", the tax number becomes "[NIF]", the address becomes "[address]". The AI helps just the same, and you put the data back at the end. Careful: this is called pseudonymising, not anonymising. If the context still gives the person away ("the only baker in the parish"), take those details out too.
Why: the law and the rules at work
Regulation (EU) 2016/679, the GDPR (the General Data Protection Regulation) says that other people's personal data may only be handled with a legal reason (Article 6) and with care. Health data has even stricter rules (Article 9). Pasting a customer list into an outside service, without permission, may break the law, with consequences for the company and for you.
Then there are the rules at your work: your contract, the internal rules or the company's instructions may forbid taking information outside, or limit which AI tools may be used. If you do not know, ask first.
Watch out
If you have already pasted data you should not have, do not hide it. Tell your manager straight away. Do not delete the conversation before that: first write down which service you sent it to, when, and what kind of data it was. Deleting does not undo the sending: the data has already left. In a company, it is the controller (usually the company or public service itself) that decides whether it has to notify the data protection authority (in Portugal, the CNPD; elsewhere, your country's equivalent). When it has to, the rule is to do so without undue delay and, where feasible, within 72 hours of becoming aware of the incident (Article 33 of the GDPR).
Keeping your chats out of training
Many services have, in their settings (usually the privacy or data section), an option so that your conversations are not used to train future models.
This is how it looks on 6 October 2026; your screen may differ.
Even with that option switched off, the list above still applies: the option changes what the company does with the text, not whether it leaves your computer.
Who owns what the AI writes?
In the European Union, the Court of Justice says that a work is only protected by copyright if it is "the author's own intellectual creation" (Infopaq judgment, case C-5/08). A text or image made only by the machine, without a creative contribution from you, is in general not protected as your work.
In practice: use what the AI makes as a draft. But there is no simple rule like "the more you change, the more it is yours". What counts are free, creative choices of your own that show in the result: what you write in your own words, what you choose, cut and arrange. How this applies to work made with AI is not yet settled. In a case that matters (a logo to register, a book to sell), talk to a specialist. This is not legal advice.
When NOT to use AI
- Health or legal decisions without a professional. AI can help you understand terms and prepare questions; the decision belongs to the doctor or the lawyer.
- Exams and assessments where the rules forbid it, at school, in a competition or on a course.
- Signing or sending something you have not read from start to finish. Whoever signs is responsible for it, not the AI.
Tip
Ask yourself: "If this goes wrong, who pays?" If the answer is "a person, someone's health or my company", the AI can help you prepare, but the decision and the final check are yours.
European AI law in a few lines
The European AI law is Regulation (EU) 2024/1689, the AI Act, and it applies in phases.
Article 4, on AI literacy, has applied since 2 February 2025 to companies and organisations that make or use AI systems.
On 27 July 2026 an amendment came into force (Regulation (EU) 2026/1744, the "Digital Omnibus" on AI). Article 4 now says that companies and organisations must take measures to promote AI literacy among the people who use these systems on their behalf, without having to guarantee a set level for each person. These measures must take into account the technical knowledge, experience, education and training of those people, the context in which the systems will be used, and the people or groups they will be used on.
In plain words: if your company has you use AI, it should help you understand it.
Official sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, on EUR-Lex. This is not legal advice.
Exercise: clean before you paste
Summarise this text in 5 simple lines, in plain English, and tell me whether I have to do anything:
[paste the text here, with labels in place of the data]
Exercise
How I know it worked a summary that makes sense even with "person A" and "[address]", and a pasted text with no names, numbers, addresses or details that give someone away (step 3).
If it didn't work
- Did the summary come out confusing? Use a different label for each person, always the same one ("person A", "person B"), instead of "[name]" for everyone.
- Not sure whether a detail is personal data? If in doubt, take it out.
- Is the text in a photo or a PDF? Copy only the paragraphs you need.
Videos
Official OpenAI video: share only what ChatGPT needs to answer, and know when to check what it says.
Privacy International shows 6 ChatGPT settings: prevent training on your data, review third-party apps, share and delete conversations, use two-step authentication and manage adverts.
Test what you learned
Corrections to this lesson (1)
- : After an external review: swapping data for labels is now called pseudonymisation (not anonymisation), because the context can still identify someone; the warning about incidents now says to tell your manager straight away and keep a record of what was sent before deleting the conversation, and explains the 72-hour deadline in Article 33 of the GDPR; links to the GDPR and to the Infopaq judgment were added; the copyright explanation no longer says "the more of your own work, the more the work is yours"; Article 4 of the AI Act now says what the measures must take into account; a legal duty under the employment contract is no longer stated without a source; the quiz options were reordered.