Before using an AI tool: a practical privacy checklist

Check an AI tool’s purpose, data settings and output before giving it information or relying on its answers.

Define the task

Describe the task and what success would look like. Organising public notes is different from processing confidential customer records. Evaluate a tool with invented or public examples first.

Remove unnecessary identifiers and confidential information. For workplace use, follow approved-tool and information-handling rules before uploading anything. A convenient interface does not establish suitability for your data.

Check current settings

Read the provider’s current privacy notice and account controls, including retention, training use, deletion, shared links and workspace access. Different account types can work differently; do not apply one plan’s explanation to another.

The Irish Data Protection Commission provides official data-protection information. This checklist organises questions; it does not determine legal compliance. Refer sensitive organisational uses to the responsible person.

Verify the output

Test a small result you can check independently. Open citations and verify that they actually support the claim. Check names, dates, links and arithmetic rather than treating polished presentation as evidence.

Retain source material and a record of changes when the result matters. For publication, a person should verify facts, quotations and image provenance. A generated summary should not silently replace its source.

Review sharing and connections

Inspect the draft for private information from prompts or attachments before sending it. Check shared-link access and connected apps. A team draft can become much more widely accessible through the wrong sharing setting.

When finished, review what remains in the account, downloads and connected systems. Use current deletion and access controls as appropriate. Repeat the assessment when the product or its policies change.