What should never go into an ordinary prompt?
Our recommended default is to keep passwords, access keys, full payment details, identity documents and sensitive employee or customer records out of ordinary AI chats. If a specialized approved workflow needs sensitive data, review that workflow explicitly. A personal subscription paid for by the company is not itself an approval.
For a writing example, replace names and identifying details with placeholders. For a spreadsheet question, use a small synthetic table that preserves the structure. For a customer email, ask whether the assistant needs the complete history or only the relevant passage.
Removing a name may not remove identity. A precise address, unusual job title or distinctive transaction can still identify someone. Work through the example with the person responsible for privacy rather than labeling it anonymous because the name column is gone.
| Information | Our recommended default | Before an exception |
|---|---|---|
| Already public material | Use an approved assistant with a clear task | Check accuracy and rights to reuse. |
| Internal process notes | Minimise and use the approved work account | Check access, sharing and retention. |
| Customer or employee data | Use only an explicitly approved workflow | Document purpose, authority and recipient services. |
| Secrets and sensitive identifiers | Keep out of ordinary prompts | Use the dedicated secure process. |
Is a business plan enough?
Compare the exact service and account, not just the vendor name. Anthropic states that its commercial products do not use inputs and outputs for model training by default, while feedback or explicit sharing can create exceptions. It directs consumer users to a separate policy. Anthropic commercial training policy; Anthropic consumer policy.
Google describes protections for Gemini inside Workspace and separately warns that sharing Workspace data with personal Gemini Apps or Search features can place it under those services' policies. The same document can cross a policy boundary when the way you access it changes. Google Workspace AI privacy guidance.
We recommend a business-managed account where your organization needs ownership and administration. Then verify the contract, settings, user removal process, sharing controls and applicable data agreement for the selected plan. Do not infer a particular control from a plan name or assume that every add-on inherits the same conditions.
The benefit is a clearer company decision about access and use. The drawback is administration and potentially extra cost. For public copy or invented examples, a simpler approved setup may be enough. For identifiable customer work, make the decision against the actual data flow.
Does no training mean the provider keeps nothing?
No. OpenAI's API documentation separates model training from abuse-monitoring logs and application state. API data is not used for training by default unless the customer opts in; monitoring and feature-specific storage can still apply. The documentation describes default abuse-monitoring retention of up to 30 days with exceptions, and separate retention for stored features. OpenAI API data controls.
That is an API policy, not a statement about every consumer chat or every third-party app. We recommend asking four separate questions: what is used to train models, what is stored to operate the feature, who can access it, and how deletion works. Record the answer for the exact route you use.
Include copies outside the model provider: integration logs, exported files, shared conversation links and the destination system. If your workflow can delete the chat but leaves a full customer transcript in a log, your retention plan has a gap. Choose a practical deletion process and test it with a synthetic record.
What do PDPA and GDPR mean for a small team?
Under Thailand's PDPA, sections 22 and 23 address necessary collection and notice. Section 24 lists grounds permitting collection without consent in specified circumstances, while section 26 covers sensitive categories. Sections 28 and 29 address cross-border transfers. The government-hosted English text is an unofficial translation. Thai PDPA.
The European Commission describes GDPR principles including purpose limitation, minimisation, accuracy, storage limitation, security and accountability. Transparency includes explaining purposes, recipients and relevant transfers. An AI subscription does not remove the organization's responsibility for the processing. European Commission GDPR principles.
For your actual operation, ask the privacy owner or qualified adviser to establish which law applies, the lawful basis, notices, supplier terms and transfer arrangements. Do not substitute a generic consent checkbox for that assessment. This guide supplies an operating starting point, not a determination that your use is compliant.
For Bangkok teams serving Europe, draw the flow before the legal review: which person provides the information, which company controls the task, which services receive it and where the result is used. That concrete picture is more useful than asking whether AI in general is allowed.
What should we check before approving a tool?
- Purpose: name the task and data genuinely needed.
- Account: identify the company-owned plan and administrator.
- Contract: review applicable terms, data agreements and supplier roles.
- Training: record defaults and any feedback or opt-in exceptions.
- Retention: cover chats, files, logs, backups and connected services.
- Access: limit who can view, share, export or connect additional apps.
- Actions: separate reading, drafting, updating and external sending.
- Exit: test removing a user, revoking access and recovering business records.
- Incident: name the person who handles accidental uploads or disclosure.
Ask for written answers and retain the review date. An unanswered retention question is a gap to resolve, not permission to assume the shortest period. Repeat the review when you add a new connection, materially change the workflow or change account type.
A one-page policy to copy and adapt
Replace every bracket before adoption. Keep this as the staff-facing page, with the approved-tool register and retention schedule linked from it. The policy below is our suggested template, not statutory wording.
Our AI use policy
Owner and date. [Name or role] owns this policy. Effective: [date]. Next review: [date]. Questions and incidents: [contact].
Approved use. We use only tools, company accounts and workflows listed in [approved-tool register]. Each entry names the owner, allowed data, permitted actions and review date. A new tool, plugin or connection needs owner approval before business data is shared.
Data. We use the smallest relevant input. Public information and synthetic examples are preferred. We do not enter credentials, complete payment details, identity documents or sensitive personal records into ordinary AI chats. Confidential or personal data requires an explicitly approved workflow and appropriate privacy review.
Accounts and connections. We use the assigned work account. We do not connect a personal inbox or broad shared drive without approval. We keep access limited to the task and remove access when a person changes role or leaves.
Accuracy and decisions. AI output is proposed work. The named reviewer checks material facts, calculations, sources and customer commitments before use. AI extraction alone does not authorize payment, hiring decisions, legal acceptance or external communication.
Sending and changes. We act only within recorded authority. A person may approve a specific action or a defined workflow. Different recipients, purposes or material changes require a scope check. We retain evidence of important actions and their outcomes.
Storage and sharing. We follow [retention schedule] for prompts, uploads, logs and outputs. We do not create public sharing links for confidential work. We keep required business records in [approved system], with suitable access.
Problems. If information is uploaded or shared incorrectly, stop the workflow and contact [owner] promptly. Preserve relevant evidence through the approved process; do not circulate the affected data. The owner coordinates containment, rights requests and any required notifications.
How do we make the policy usable?
Give staff realistic examples of allowed and disallowed inputs from their own jobs, using synthetic data. Show the approved account and how to check it. Practice an accidental-upload scenario so people know who to contact without needing to improvise under pressure.
Start with a narrowly approved task and review the first outputs. Ask whether staff can find the right source, recognize an uncertain answer and explain where the data went. If following the policy makes the task impractical, redesign the task rather than expecting people to work around the policy silently.
The advantage of a short policy is a clear daily decision. Its limitation is that it cannot replace supplier assessment, technical permissions or the company's other obligations. Keep the detailed register with the owner and make the staff page point to it.
What do we use, and where should you start?
At DLVX, our documented setup separates access material from ordinary work, uses scoped authorization for external actions and checks outcomes against source systems. We treat written instructions as part of the process, with verification of what actually happened. That is an operating description, not a legal certification. DLVX editorial review.
Common mistakes are confusing paid with business-approved, equating no training with no retention, copying an entire inbox into a prompt and forgetting that a connector creates another data recipient. Check all four before broadening a pilot.
Next step: choose one task your team already performs with AI. Trace its input, account, connected services, output and deletion route. Fill in the policy owner and approved-tool entry before adding more data or more automation.
Sources and review date
Reviewed 12 October 2026. Prices and plans are as of October 2026. DLVX recommendations are editorial judgements, not a vendor ranking or a promise of results. Recheck the linked terms before buying or connecting business data.
- Anthropic commercial training policyChecked 2026-10-12. Commercial no-training default and feedback or permission exceptions.
- Anthropic consumer training policyChecked 2026-10-12. Separate policy applies to consumer plans.
- Google Workspace AI privacy guidanceChecked 2026-10-12. Workspace protections differ from personal Gemini Apps or Search sharing.
- OpenAI API data controlsChecked 2026-10-12. No-training default is separate from retention and application state.
- Thai PDPA government-hosted unofficial English translationChecked 2026-10-12. Sections 22 to 29 address collection, notice, lawful grounds, sensitive data and transfers.
- European Commission GDPR principlesChecked 2026-10-12. Purpose, minimisation, accuracy, storage, transparency, security and accountability.
- DLVX editorial reviewChecked 2026-10-12. Internal access, authorization and outcome checking habits.
Want to apply this to your team? Get a free AI plan.