You might be breaking GDPR every time you open AI.The thing I see most when I work with businesses has nothing to do with strategy. It is a habit. Someone pastes a customer list, a signed contract, or an export of the whole CRM into an AI tool, and never once stops to think about privacy. Customer lists. Patient notes. A full client database. It all goes in with one paste, and out comes something tidy in seconds. That speed feels like a gift. It is also a decision with legal weight, and most people never notice they made it.
Here is how I think about it, and the simple rule I give the businesses I work with. 1 / Why it is so temptingAI makes the painful work disappear. The afternoon you used to spend sorting a messy spreadsheet, summarising a long email thread, or cleaning up meeting notes now takes a minute. The friction that used to slow you down also used to make you think twice about your data. Remove the friction and the second thought goes with it. 2 / The line most people missWhen you paste a customer's name, a patient's record, or a signed contract into a public AI tool, you have handed personal data to a third party. Under GDPR that counts as processing, and you usually have no lawful basis for it and no real idea where the data ends up. The summary it gives you back is fine. The problem is the data leaving the building in the first place. 3 / The rule I actually useThree steps, in order. First, strip the identifiers. Replace real names with Client A and Patient 1 before you paste. The model does not need the real name to do the work. Second, if you cannot strip it, run it locally on a model on your own machine, so nothing leaves your laptop. Third, if you can do neither, do not do it at all. Some data is not worth the shortcut. 4 / What this means for a small businessYou do not need a legal team or a compliance department. You need one habit. Before anyone on your team pastes something in, they ask two questions. Whose data is this, and would I be comfortable if it showed up somewhere I did not choose. That pause costs nothing and prevents almost every problem. Setting up that kind of simple, plain rule is most of what I do with the businesses I help.
The quick paste test
Good data discipline and honest work turn out to be the same muscle. You protect what is not yours, and people trust you with more. Talk soon, Mikkel P.S. Hit reply and tell me one tool your team pastes data into without thinking about it. That is usually where the exposure is hiding.
The AI Solopreneur • AI Strategy for European SMBs |
