Lessons and outlineLesson 5 of 10
AI Governance & Risk LeadLesson 5
Data Privacy & Intellectual Property Risks
Personal data and IP risks with AI, and the practical controls that reduce them.
Personal data can leak through prompts, training, outputs and retention. Apply purpose, legal basis, minimization and rights, and use approved tools with business terms. Intellectual property risks cover inputs, outputs, ownership and licenses. Make the safe path the easy path.
- Personal data
- Information about an identifiable person.
- Impact assessment
- A written check of the risks of a use, done before launch.
- Trade secret
- Valuable confidential information that must be kept secret.
Approved tools with business terms make the safe path the easy path.
- Pasted into prompts
- Kept in logs
- Repeated in outputs
- Secrets entered into tools
- Output that resembles protected work
- Unclear ownership
Two big risks sit beside every AI project: personal data and intellectual property. Staff paste customer details into chat tools. Models may repeat private text or copy protected work. Teams ask who owns what the AI makes. This lesson explains the common problems in plain words and what governance can do about them.
Personal data and AI
- Prompts: people paste names, emails, health details or contracts into AI tools.
- Training and tuning: data used to improve a model may be kept or used for others.
- Outputs: a model may repeat personal data it saw in context or in training.
- Profiling: using data to judge or predict things about people can create privacy and fairness risks.
- Retention: logs and chat histories hold data longer than people expect.
Privacy basics to apply
PURPOSE Why do we need this personal data? Is it for a clear, stated purpose? LEGAL BASIS What lawful reason do we have? Is consent needed and recorded? MINIMIZE Can we do the task with less data, masked data or none? PROVIDER Does the provider use our data for training? Where is it stored? For how long? RIGHTS Can we find, correct and delete a person's data when they ask? IMPACT CHECK Is a data protection impact assessment needed for this use? SENSITIVE Does it touch health, children, biometrics or other special data? TRANSFER Does data move across borders? What protections apply? RETENTION How long do prompts, logs and outputs stay, and who can read them?
Practical controls for personal data
- Approve tools that give business terms: no training on your data, clear retention, deletion on request.
- Block or warn when staff paste personal data into unapproved tools.
- Mask or remove personal data before it reaches a model when the task does not need it.
- Keep short retention for prompts and logs, and limit who can read them.
- Run an impact assessment before high-risk uses.
Intellectual property risks
- Input risk: staff paste confidential company information or others' protected work into a tool.
- Output risk: generated text, code or images may resemble protected work.
- Ownership: who owns generated content can be unclear. It may depend on the law and the human input.
- Licenses: code or data from an AI may carry license duties. Open-source rules still apply.
- Training data: questions about whether a model was trained on protected work affect vendor risk.
Practical controls for IP
- Set rules on what confidential material may be entered into AI tools.
- Ask vendors about their training data sources and whether they offer protection against claims.
- For code, use scanning for license issues and review generated code like any other code.
- For important content, keep human authorship and records of the creative steps.
- Check contracts with clients and staff to see who owns AI-assisted work.
Trade secrets and confidentiality
A trade secret can lose its protection if it is shared without proper care. Pasting a secret formula into a public tool may count as a leak. Make clear which information is secret, and which tools are approved for it.
Talk to people, not only about rules
Most privacy and IP slips are honest mistakes. Give staff short, concrete examples: this is fine, this is not, and this is how to ask. Offer an approved tool that makes the right thing the easy thing.
- ✓Personal data can leak through prompts, training, outputs, profiling and retention. Apply purpose, legal basis, minimization and rights.
- ✓Use approved tools with business terms, masking, short retention and impact assessments for high-risk uses.
- ✓IP risks cover inputs, outputs, ownership, licenses and training data. Use clear rules, vendor questions and code scanning.
- ✓Make the safe path the easy path with approved tools and concrete examples.
Write the staff guidance
- Write a one-page guide for staff on personal data and AI tools, with five do and five do-not examples.
- Add a short section on confidential and protected material.
- List six questions you would ask a vendor about data and training.
- Write one message that tells staff which approved tool to use instead, and why.
Q1Why do free and business versions of a tool matter?show answer
They can have different data terms. A free plan may retain or use data in ways a business plan does not.
Q2What does data minimization mean?show answer
Using only the data the task needs, and masking or removing the rest.
Q3Why can pasting a secret into a public tool harm trade-secret protection?show answer
Sharing it without proper care can count as disclosure, which may weaken the legal protection.