Guide · AI & confidentiality
Generative AI and sensitive data: what are the risks and precautions?
Generative AI can be used in a professional context, but the mere fact that a service is “professional” does not make every document appropriate to send. You first need to determine which information is really necessary, reduce what is not, check the provider’s terms and keep human control over both the data sent and the answer received.
Start with the nature of the information
In everyday language, “sensitive data” can mean any information whose disclosure would be a problem: a client file, strategy, financial information, human resources, trade secrets or data covered by professional secrecy. The GDPR also uses a more precise notion of special categories of data, notably for health, political opinions, religious beliefs or biometric data used to identify a person.
In both cases, the right question is not just “can I use AI?”, but “what information does the AI really need to do this task?”.
The main risks to examine
- Transfer to a third party: the request leaves your environment to be processed by the chosen AI provider.
- Indirect identification: a document can remain identifiable even after names are removed.
- Provider terms: training, retention, subprocessors, location or settings can vary by plan and account.
- Accuracy: a generated answer can be plausible without being correct, complete or up to date.
- Professional obligations: professional secrecy, contractual confidentiality, internal policy or sector regulations still apply.
Six simple precautions before sending
State the need before adding data. A summary or rewording can often be done without real identities.
Send only the passages and information the task needs.
Remove, generalise or pseudonymise information the model does not need to know.
Read the terms of the plan actually used, especially on how content is used and retained.
Reread the version that will actually go to the provider, including indirect identifiers.
Treat the answer as content to check, not as an authoritative source in its own right.
API or business plan: useful, but not enough on its own
Providers offer plans and APIs with data policies that differ from consumer services. This can be significant protection. But these guarantees do not answer every question: unnecessary data is still unnecessary to send, a secrecy obligation still applies, and a pseudonymised document may still contain information allowing indirect identification.
Where does NYMETRA fit?
NYMETRA steps in precisely at the preparation stage before sending: the document is analysed in the client’s environment, the user controls the information to protect, and the pseudonymised version the request needs is sent directly to the chosen AI provider. The aim is to reduce exposure without claiming that software alone is enough to guarantee compliance or every professional obligation.
If your difficulty is mainly practical - how to remove identifiers without making the document unusable - see the guide on pseudonymising before ChatGPT, Claude or Gemini.