What to Do If You Pasted Confidential Data Into an AI Chatbot

It happens to careful people. You are rushing, you paste a draft into a chatbot to tidy it up, and a second later you realise it contained a client’s financials, a colleague’s medical details, or a contract your company signed an NDA about.

Panic is understandable but not useful. What you do in the next hour matters more than the mistake itself. Here is a calm, practical sequence.

Step 1: Stop Adding To It

Do not continue the conversation, and do not paste anything else. If the chat is still open, note what you pasted (roughly), the time, and which tool and account you used. You will need those details.

Step 2: Delete The Conversation

Most AI chat services let you delete a conversation from your history. Do it. Be clear with yourself about what this does and does not achieve:

• It removes the chat from your account and usually stops it being used for training if that setting was on.
• It does not guarantee immediate deletion from the provider’s systems. Many providers keep data for a period for safety and abuse monitoring, and legal holds can extend that.

Check the provider’s data controls while you are there, and turn off training on your conversations if the option exists.

Step 3: Tell The Right Person, Today

This is the step people skip, and it is the one that matters most.

• At work: tell your manager and your data protection or security contact. Most organisations would far rather hear about it in an hour than discover it in a month.
• If you are a freelancer or consultant: you may need to tell the client, depending on your contract.

Under the GDPR, a personal data breach that is likely to risk people’s rights must be reported to the regulator within 72 hours of the organisation becoming aware of it, as set out in Article 33. Whether a paste into a chatbot meets that threshold depends on the data, the service and its terms, which is exactly why the decision belongs to someone who can assess it, not to you alone at your desk.

Step 4: Write It Down Plainly

A short factual note helps whoever assesses it.

Before:

So I might have messed up, I put some stuff into ChatGPT earlier by accident, I think it was the Henderson file maybe, sorry, I deleted it after

After:

At about 14:20 today I pasted the draft of the Henderson settlement letter into ChatGPT (personal account, free plan) to fix the wording. It included the client’s name, address and the settlement figure. I deleted the conversation at 14:35 and have turned off training in my settings. Nothing else was shared. Please let me know what you need from me.

The second version gives the facts someone needs: when, what, which service, what you already did. See how to write an incident report at work.

A Wrivio Context for incident notes could say:

Rewrite this as a short, factual incident note to my manager. Calm, specific and accountable, no excuses and no speculation. Include what happened, when, which tool, what data was involved, and what I have done since. Keep every time, name and detail exactly as written. Do not minimise or add anything that is not in the original.

Press Ctrl+Shift+Space, paste your rough note, and send the factual version.

Step 5: Follow The Assessment

Your organisation may decide no further action is needed, or it may contact the provider, the client, or the regulator. Cooperate, and do not try to manage it yourself by, for example, emailing the client directly without agreement.

Step 6: Fix The Workflow, Not Just Yourself

Mistakes like this happen when the safe option is slower than the risky one. Reminders to “be careful” do not hold up at six in the evening. Practical fixes:

• Make a local tool the default for confidential text. A rewrite that runs on your own machine cannot leak to a provider. See which tasks should stay local.
• Use an approved enterprise AI account for work, with training off and clear retention terms.
• Separate personal and work AI accounts, so work text never lands in a consumer account by accident.
• Check browser extensions and built-in AI features that send page content automatically.

Common Questions

Does deleting a ChatGPT conversation delete the data?

It removes it from your account and history. Providers typically retain deleted data for a limited period for safety and legal reasons, so deletion reduces exposure but is not the same as the data never having been sent.

Is pasting data into a chatbot a data breach?

It can be, if personal data was disclosed to a party without a lawful basis. Whether it is reportable depends on the data, the risk to the people involved and the service’s terms, so let your data protection contact assess it.

Will I get in trouble at work?

Organisations generally treat prompt, honest reporting far better than a mistake that is hidden and found later. Reporting quickly is the best thing you can do for yourself and for the people whose data was involved.

What if it was my own personal information?

Then it is your decision. Delete the conversation, review the service’s data settings, and consider whether any passwords or account numbers need changing.

Download Wrivio for Windows to make the private option the fast one, with confidential rewrites that never leave your machine.