Stop Your Staff from Pasting Client Data into Public AI Tools: A Guide to Shadow AI and Data Leak Prevention

Summary

This guide helps you troubleshoot and resolve: Stop Your Staff from Pasting Client Data into Public AI Tools: A Guide to Shadow AI and Data Leak Prevention. Follow the steps below to fix the issue.

Common Causes

Shadow AI occurs when employees use consumer-grade artificial intelligence tools—such as public chatbots and image generators—without organisational oversight. When staff paste client records, proprietary code, or financial spreadsheets into these platforms, that data often leaves your secure environment and may be used to train public models. For Australian businesses, this creates significant risks under the Privacy Act 1988 and the Australian Privacy Principles (APPs), potentially leading to notifiable data breaches and loss of client trust.

Quick Fix Steps

1. Identify which public AI tools your staff are currently accessing on company devices.
2. Block unauthorized AI domains at the network or endpoint level.
3. Deploy an enterprise-grade AI alternative with commercial data protection.
4. Train employees on what data must never be pasted into public AI platforms.
5. Update your acceptable use policy to explicitly cover generative AI.

Detailed Instructions

1. Audit Current AI Usage

Review web filtering logs, browser history, and endpoint management reports to identify visits to consumer AI platforms. Common indicators include frequent access to public chatbot domains and large file uploads to unknown external sites. Speak with team leads to understand which departments are experimenting with AI and for what purposes.

2. Restrict Access to Public AI Tools

Use your firewall, DNS filtering, or endpoint management console to block known consumer AI domains. If you use Microsoft Intune or a similar mobile device management (MDM) platform, create a configuration profile that restricts access to unauthorized web categories. Ensure the block list is regularly updated as new AI tools emerge.

Blocking access without providing an approved alternative often drives staff to use personal devices or mobile hotspots, which reduces visibility rather than eliminating the risk.

3. Deploy Enterprise-Grade AI with Commercial Data Protection

Provide staff with a secure, managed AI environment. Microsoft Copilot with commercial data protection ensures that user and organisational data is not used to train the underlying public foundation models, provided users sign in with their organisational Microsoft 365 account.

1. Assign appropriate Microsoft 365 licenses that include Copilot with commercial data protection to your users.
2. Configure Copilot with commercial data protection in your organisation's admin settings.
3. Instruct staff to sign in at copilot.microsoft.com using their work email address, not a personal Microsoft account.
4. Verify that the protected badge or enterprise sign-in indicator appears before any data is entered.

Always confirm the user is signed in with their organisational credentials. Consumer accounts signed into the same interface do not receive commercial data protection.

4. Establish Data Handling Rules

Create clear rules about what information may be processed by AI tools. As a baseline, prohibit pasting the following into any AI platform unless it is your approved enterprise environment:

• Client names, contact details, and personal information
• Customer databases, invoices, or financial records
• Proprietary source code or intellectual property
• Employee records and payroll information
• Confidential contracts or legal documents

5. Update Your Acceptable Use Policy

Revise your organisation's acceptable use and IT security policies to include generative AI. The policy should define approved tools, prohibited data types, and the process for requesting new AI software. Require all staff to acknowledge the updated policy, and include AI awareness in your onboarding and annual security training.

Troubleshooting

Staff Continue Accessing Blocked AI Sites

If users are bypassing network blocks, check for personal mobile devices on your Wi-Fi, VPN tunnels, or proxy services. Ensure your filtering solution applies to both wired and wireless networks, and consider deploying DNS-level protection that covers roaming devices.

Employees Are Unsure Which AI Tool Is Approved

Publish a simple internal page listing the approved enterprise AI platform and how to access it. Include screenshots showing the correct sign-in screen and the commercial data protection indicator so staff can verify they are in the secure environment before starting work.

Data May Have Already Been Pasted into a Public AI Tool

If you suspect client data has been entered into a consumer AI platform, treat it as a potential data breach. Document what information was shared, when, and by whom. Assess whether the incident meets the notifiable data breach threshold under the Privacy Act 1988, and seek legal advice if client personal information may have been exposed.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?