Heidelberg AI Curriculum

T12-L01 · Security, privacy & governance · Level 1 User · 10-minute read, plus 15 minutes of doing

18:40, and nobody told you the rule

In a lab it's 18:40. Your PI wants a half-page summary of a collaborator's manuscript for tomorrow's 9:00 meeting. The PDF is forty pages, unpublished, and arrived with "please keep confidential" in the email. A chat assistant would summarise it in a minute.

In a company it's the same time. Sales needs the payment terms, notice period and liability cap from a customer contract before a call tomorrow morning. The contract is twenty pages, with signatures and the customer's bank details on the last page.

In both cases nobody has told you what you may paste into an AI tool. The tool won't stop you. This book gives you a rule that takes seconds to apply, three ways to get the job done even when the answer is "not like that", and the words to explain it to the next colleague who asks.

You are at Level 1 User. The rule protects other people as much as you: their data, their unpublished work, your organisation's secrets.

After this you can

Classify anything you want to paste as green, yellow or red in a few seconds.
Rewrite a red request so it becomes green, using one of three ways.
Tell an approved tool from a personal account, and a paid plan from a protected one.
Explain the rule to a colleague in two sentences.

Before you start

Book: T01-L01 · From Idea to Working Result: The Four-Quadrant Method. Its fact 4 is where this book starts.
Your chat history in whatever AI tool you use, to find your last five pastes.
Your organisation's list of approved AI tools, if there is one. Look on the intranet, or ask IT or your data protection contact.
25 minutes: 10 to read, 15 to do.

Last verified 23 September 2026. On personal ChatGPT and Gemini accounts, chats may train the models unless you change a setting. ChatGPT's business plans don't train on it by default. Copilot Chat with a work account runs under your organisation's agreement. Details for experts at the end of this book.

The idea in one page

What happens when you paste. The text leaves your organisation and is processed on the provider's servers. On a personal or consumer account, assume it is stored, may be read by a human reviewer, and may be used to improve the service. That's true on many paid personal plans too. What protects your data is a business agreement between your organisation and the provider, not the price you pay.

The rule in three colours:

Colour	What it is	Where it may go
Green	Already public: published papers, your website, public standards, a press release. Or something you made up.	Any tool. Paste freely.
Yellow	Internal but not sensitive: meeting notes without names, a draft newsletter, an internal how-to, your own code with no passwords in it.	Approved tools only. "Approved" means your organisation has a business agreement with the provider and has said this tool is fine.
Red	Personal data (names with anything about the person), health or patient data, passwords and keys, trade secrets, prices and contracts, unpublished results, anything under an NDA (a non-disclosure agreement) or marked confidential, and other people's work shared in confidence.	Nowhere, unless someone who may decide has cleared this exact use in writing.

The one-sentence test. When you're unsure, ask: would I be comfortable seeing this on a public website with my organisation's name on it? If yes, it's green. If you'd wince, it's at least yellow. If it could hurt a person, a partner or the business, it's red. When in doubt, go one colour up.

Three ways to work with red material anyway:

Anonymise first. Remove or replace names, customer names, sample IDs linked to people, prices and anything else that points to someone. Be careful: a rare disease plus a town plus an age can identify a person without a name. If you can't make it harmless, it's still red.
Ask about the form, not the content. Don't paste the contract; ask "What are the usual payment and liability clauses in a supply contract, and how do I find them quickly?" Don't paste the manuscript; ask "What questions should a half-page summary answer if my PI must decide whether to join a follow-up study?" You do the reading with a better plan.
Use an approved tool with a proper agreement, within what your organisation has cleared for it. Some red material may be cleared for an approved tool; some never is. A local model, an AI that runs on your own laptop (T11-L01), is another route for text that must not leave the building, but it doesn't make someone else's data yours to use.

Shadow AI, honestly. Shadow AI means AI tools people use at work without their organisation knowing. People use personal accounts at work because it's quick and nobody gave them anything better. Banning it rarely works. What works is a clear rule like this one and one approved tool people can actually use. If your organisation has neither, this book gives you the rule, and T13-L03 shows how to write the one-page policy.

Worked example: two red documents at 18:40

Both cases go through the four quadrants from T01-L01.

Lab: the collaborator's manuscript

Structure it. "By 9:00 my PI needs half a page on the collaborator's manuscript: the main claim, the methods, and what they're asking of us. The manuscript is unpublished and was sent in confidence." Colour: red. It's unpublished, it isn't hers, and the email says so.

Understand it. What does the PI actually need? A decision: join the follow-up study or not. Does the institute have an approved tool? The intranet lists a licensed assistant with a data agreement. But the manuscript belongs to the collaborator, and "in confidence" means the collaborator decides who processes it. She emails to ask whether she may use the institute's approved tool. No reply by 19:00. Back to Structure it: "The hard part was never the typing. It's knowing what to look for in forty pages."

Choose tools. Way 2: ask about the form. The public chatbot gets no content at all, so the request is green. The reading stays hers.

Build it. She asks: "My PI must decide whether to join a follow-up study based on a collaborator's manuscript. List the six questions a half-page summary should answer, and where in a typical paper I find each answer." She reads the manuscript with those six questions and writes the half page in forty minutes. What it taught her: next time, ask collaborators up front whether the approved tool is fine for their drafts.

Company: the customer contract

Structure it. "By tomorrow morning, sales needs three terms from a customer contract: payment terms, notice period, liability cap, each with its clause number." Colour: red. It's a customer contract with prices, names and bank details.

Understand it. The company's one-page AI rule lists Microsoft Copilot Chat, used with the work account, as approved for internal and customer documents, but not for employees' personal data. He checks for the green shield at the top of the window, which shows that the work account's protection is on. He also asks himself whether the tool needs the customer's name, the signatures or the bank details to find three clauses. It doesn't.

Choose tools. Ways 1 and 3 together: the approved tool, and only what the job needs. He deletes the signature page, replaces the customer's name with "Customer", and leaves the prices out.

Build it. He pastes the cleaned text and asks for the three terms with clause numbers, quoted word for word. Two come back correct. The payment terms say "see Annex B", which he hadn't included. He opens the annex himself and finds the answer in a minute. What it taught him: a cleaned-up copy can leave out the part that matters. Check what's missing before you trust what's there.

In both cases the answer to "may I paste this?" was no, and the job still got done. The rule didn't stop the work. It changed the route.

What goes wrong

Assuming a paid plan means protection. Symptom: "I pay for Plus, so my data is safe." Fix: check whether there's a business agreement. Personal paid plans are still personal accounts. Look for your organisation's approved tool instead.

Assuming a European-sounding name means European processing. Symptom: you pick a tool because the company is based in Berlin or Paris. Fix: the company's address tells you where it sits, not where the model runs. Ask your data protection contact which tools have an agreement that covers where the data is processed.

Uploading the whole PDF "because I only want a summary". Symptom: forty pages go in, including the one page with names and figures, when you needed three clauses. Fix: send only what the question needs. Remove the rest first.

A private account, "just this once". Symptom: the approved tool is slow or clumsy, so you switch to your personal account for one urgent document. Fix: urgency is when mistakes happen. Use one of the three ways, or wait. If the approved tool is really unusable, say so to whoever chose it.

Pasting a colleague's data because it isn't yours. Symptom: "It's her spreadsheet, not mine, so I'm not responsible." Fix: you're responsible for what you paste. Other people's data is red until whoever it belongs to has cleared it.

Taking the names out and calling it anonymous. Symptom: a case description without a name, but with the rare diagnosis, the ward and the date. Fix: check the combination, not just the name. If someone who knows the context could recognise the person, it's still red.

Do it yourself (15 minutes)

Structure it (3 min). Open your AI tool's history and copy your last five pastes into a document. Only the first line of each is enough; don't copy the sensitive part again.
Understand it (5 min). Give each one a colour and a one-line reason, using the table and the one-sentence test. Note which tool and account you used for each. Find out whether your organisation has an approved tool; if you can't find out in two minutes, write down who you'll ask.
Choose tools (2 min). For every red one, pick one of the three ways: anonymise, ask about the form, or an approved tool.
Build it (5 min). Rewrite each red paste so it becomes green. Try one of the rewrites, and check that the answer still does the job.

If one of your pastes was red and went to a personal account, don't panic and don't hide it. Delete the chat, and tell your data protection contact or your manager what went where. A mistake reported early is easy to handle.

Exit check

Delivered artifact: a short list of your last five pastes.

Each paste: what it was (in one line, without the sensitive content), its colour, and a one-line reason.
Each red paste: your rewrite, and which of the three ways you used.

It passes when a colleague agrees with each colour and no rewrite still contains red material.

Rule to remember

Green is public. Yellow is approved tools. Red is nobody's business but ours.

Details for experts

Checked on 23 September 2026. You don't need this to follow the book; it's for setting things up or answering a colleague.

What	Details	What it means for you
ChatGPT, personal plans	Free, Go, Plus and Pro. Your chats can be used to train OpenAI's models, which means improving the next version with them, unless you switch off Settings → Data controls → Improve the model for everyone.	A paid personal plan is still a personal account: green material only.
ChatGPT, business plans	On ChatGPT Business, Enterprise and Edu, OpenAI doesn't use your content for training by default.	These can become approved tools once your organisation has a contract.
Gemini, personal Google account	Human reviewers read some chats, and reviewed chats are kept for up to three years. Switching off Keep Activity stops future chats being reviewed to improve Google's services, but Google still uses them to answer you and for safety, including with human review.	The switch helps, but it doesn't make a personal account right for yellow or red material.
Microsoft Copilot Chat, work account	Formerly Microsoft 365 Copilot Chat. Signed in with a work or school account, it runs under your organisation's data protection agreement with Microsoft, and prompts aren't used to train foundation models, the large base models behind the product. A green shield at the top of the window shows the protection is on.	No shield, no protection: check before you paste.
Copilot and the EU	Microsoft's own documentation says Copilot's web searches and its Anthropic models fall outside its EU Data Boundary, Microsoft's commitment to keep EU customers' data in the EU.	Before pasting customer material, ask IT whether those features are switched on.

If these details change, the rule stays the same.

Decide What You May Paste Into AI at Work