AI assistants such as ChatGPT, Claude, Gemini and Copilot can save hours of work, but careless use can leak confidential information, spread mistakes or breach data protection law. This checklist helps employees and managers use them safely.
1. Know what happens to your data
Before using any AI tool for work, check:
- Whether your conversations are stored, and for how long
- Whether the provider may use your inputs to train its models, and how to opt out
- Whether a business or enterprise plan offers stronger data protections
- Where data is processed, which matters for cross-border transfer rules
Business plans from major providers generally offer more control over data than free consumer accounts. If your employer has approved a specific tool, use that one.
2. Never paste these into a public AI tool
- Passwords, PINs, one-time codes or API keys
- Customer names, phone numbers, ID numbers or account details
- Health, financial or other sensitive personal data
- Unreleased financial results, contracts or trade secrets
- Source code your employer has not approved for sharing
If you need help with a document that contains personal data, remove or replace the identifying details first.
3. Check everything the AI tells you
AI assistants can hallucinate, producing confident but wrong answers. This is especially risky for legal rules, tax rates, regulatory deadlines, medical information, statistics and citations. Verify against primary sources such as the regulator’s website or the law itself. Learn why this happens in What Is Generative AI?
4. Understand the legal side
Most African data protection laws, including Nigeria’s Data Protection Act 2023, Kenya’s Data Protection Act 2019 and South Africa’s POPIA, require organisations to have a lawful basis for processing personal data and restrict transfers outside the country. Uploading customer data to an overseas AI service may count as processing and transfer. Compare the main rules in Data Protection Laws in Africa.
5. Secure your AI accounts
- Use a strong, unique password and turn on two-factor authentication; see 2FA explained
- Do not share logins between colleagues
- Be careful with browser extensions and third-party apps that request access to your AI account or documents
- Watch for phishing emails pretending to be from AI providers
6. Be transparent
Tell your manager or client when AI has been used substantially in your work, and follow your organisation’s policy. Customers should know when they are talking to a bot.
7. For managers: write a simple AI policy
A one-page policy should cover:
- Which AI tools are approved
- What data must never be entered
- Which outputs need human review before use
- How AI use should be disclosed
- Who to ask when unsure
Quick checklist
- Approved tool? ✓
- No passwords or personal data entered? ✓
- Facts and figures verified? ✓
- Output reviewed by a person? ✓
- AI use disclosed where needed? ✓
Ready to apply AI in your organisation? Read How African Businesses Can Start Using AI or go back to the AI in Africa guide.
