Lesson 4.1: Data Privacy Basics

Purpose

You can use AI to help your work. But not everything you do should go into AI systems. This lesson teaches guardrails: what information is safe to share with AI, what's risky, and how to protect sensitive data.

By the end, you'll have a personal policy for what you will and won't put into AI tools.

Why This Matters for Managers

Data privacy isn't just about GDPR and compliance. It's about trust and responsibility.

Poor data practices lead to:

• Confidential business information leaking
• Employee data being exposed (legal issue)
• Customer information vulnerability
• Breach of trust if team finds out
• Personal liability (you made the decision)

Good data practices mean you use AI responsibly and protect what you're responsible for.

Core Concepts

Information Categories

Not all information is created equal. Understand the categories:

Category 1: Public Information

What it is: Information that's already public or would be fine if public.

Examples:

• Published articles or research
• Public company announcements
• General industry knowledge
• Publicly available market data
• Published best practices

Risk level: Minimal. Safe to use with AI.

OK to share with AI: Yes.

Category 2: Proprietary Business Information

What it is: Information that gives your company competitive advantage.

Examples:

• Unreleased product features
• Pricing strategy
• Customer lists or deal pipelines
• Financials (revenue, profit, forecasts)
• Strategy or roadmaps
• Code (proprietary code)
• Research results

Risk level: High. If exposed, damages competitive position.

OK to share with AI: Generally no, unless it's an approved internal tool with strong protections.

Why it's risky:

• Free public AI tools may store and use your input for training
• Data could theoretically be seen by competitors who use same tool
• Breach of confidentiality to your board, investors, or partners

Category 3: Personally Identifiable Information (PII)

What it is: Information about specific people.

Examples:

• Names tied to performance data
• Email addresses or phone numbers
• Salary information
• Social security numbers
• Health information
• Location data
• Authentication credentials

Risk level: Very high. Privacy and legal implications.

OK to share with AI: Generally no, unless anonymized.

Why it's risky:

• Privacy violations (employee or customer)
• Legal liability under data protection laws
• Breach of trust if people find out their data was shared
• Identity theft risk if credentials or PII are exposed

Category 4: Confidential Communication

What it is: Sensitive conversations or decisions.

Examples:

• Private conversations with executives
• Termination planning or conversations
• Sensitive feedback about employees
• Confidential HR matters
• Legal strategy or privilege
• Board discussions
• Anything marked "confidential"

Risk level: Very high. Legal, ethical, and relationship implications.

OK to share with AI: Generally no.

Why it's risky:

• Violates confidentiality obligations
• Could expose sensitive decisions or strategies
• Could harm individuals or relationships if exposed
• Potential legal liability

Category 5: Anonymized/Aggregated Data

What it is: Information with identifying details removed.

Examples:

• "Three team members said they want more feedback" (not named)
• "Customers in the enterprise segment want faster support" (not identified)
• Aggregated metrics (team size, company revenue if disclosed publicly)
• General feedback themes without attribution

Risk level: Low to medium. Generally safer than identified data.

OK to share with AI: Generally yes, with care.

Why it's safer:

• Specific individuals can't be identified
• Competitive sensitivity reduced
• Privacy risk minimized

Your Data Privacy Decision Framework

Before you share anything with AI, ask:

Question 1: Is this information public or would it be fine if public?

• Yes → Probably OK to share
• No → Proceed to Question 2

Question 2: Does this contain identifying information about a specific person?

• Yes → Don't share (unless anonymized)
• No → Proceed to Question 3

Question 3: Does this contain proprietary or confidential business information?

• Yes → Don't share (unless using approved internal tool)
• No → Probably OK to share

Question 4: Am I uncertain about whether I should share this?

• Yes → Don't share it. Ask first.
• No → You've evaluated it

Result:

• If all questions = "No" or "Probably OK" → Safe to share
• If any question = "Yes" → Don't share, or anonymize first

Practical Managerial Use Cases

Case Study 1: Performance Feedback (What NOT to Do)

Scenario: You're preparing feedback for your annual performance reviews. You ask AI to help organize feedback themes.

What NOT to do:

        "Here's feedback from my team on Sarah Chen, John Martinez, and Angela Patel:
Sarah: Misses deadlines, needs better time management...
John: Great technical skills, could improve communication...
Angela: Exceeded expectations, ready for promotion..."
        

Why this is wrong:

• This identifies specific people by name
• Contains sensitive performance information
• If exposed, violates privacy and trust
• Legal risk (employment law implications)

What to do instead:

        "I have feedback on three team members from their peers. Common themes:
One person struggles with deadline management and time prioritization
One person has strong technical skills but could improve communication
One person has exceeded expectations and is ready for more responsibility
        
        Help me structure how I'll discuss these themes in feedback conversations."
        

Why this works:

• No one is identified
• Themes are preserved
• AI can help without privacy risk
• You can still get assistance on feedback approach

Case Study 2: Customer/Market Information (What NOT to Do)

Scenario: You're analyzing customer feedback and want AI to help identify patterns.

What NOT to do:

        "Here's a list of our key customers and their feedback:
Acme Corp (revenue: $2M): Wants faster onboarding
Global Industries ($5M): Concerned about reliability
FastStart Inc ($500K): Loves the product but wants X feature...
        [List 20 customers with revenue and feedback]"
        

Why this is wrong:

• Reveals customer list (proprietary)
• Includes customer revenue (confidential)
• Could expose strategy to competitors

What to do instead:

        "Our customers are asking for three things most frequently:
Faster onboarding (mentioned by 40% of customers)
Better reliability (mentioned by 30%)
Specific feature request (mentioned by 25%)
        
        Help me think about how to prioritize addressing these needs."
        

Why this works:

• Patterns preserved without identification
• Competitive information protected
• AI can help with analysis
• No privacy risk

Case Study 3: Code or Technical Information (What NOT to Do)

Scenario: You're managing an engineering team and want to ask AI about code review practices.

What NOT to do:

        "Here's our current codebase snippet:
        [Paste proprietary code]
        
        I want to improve our code review process. What do you think of this code?"
        

Why this is wrong:

• Proprietary code is shared externally
• Competitors using same AI could see your code
• Intellectual property risk

What to do instead:

        "Our team does code review. We want to improve it. Current challenges:
2-3 day turnaround on reviews (we want faster)
Junior developers sometimes wait for senior reviews
Reviews sometimes miss edge cases
        
        What are best practices for code review processes that address these?"
        

Why this works:

• Describes challenges without sharing code
• AI can provide general best practices
• Your code stays proprietary
• You get help with process improvement

Case Study 4: Organizational Data (What NOT to Do)

Scenario: You're analyzing team metrics and want AI to help identify trends.

What NOT to do:

        "Here's my team data:
Sarah: Engineer, 4 years tenure, $150K salary, performance: Excellent
John: Engineer, 2 years, $120K, performance: Good
Angela: Manager, 6 years, $180K, performance: Excellent
        [Team list with names, salaries, tenure]"
        

Why this is wrong:

• Personally identifiable information (names + salaries)
• Compensation data is confidential
• Violates privacy of team members
• Could violate pay equity compliance

What to do instead:

        "My team has:
3 engineers with 2-4 years tenure
2 engineers with 6+ years tenure
1 manager with 6+ years tenure
        
        Average tenure: 4 years. Performance distribution: 5 excellent, 2 good. Looking at tenure vs. performance, help me think about development and growth opportunities."
        

Why this works:

• Patterns preserved
• No individual identification
• No specific compensation data
• No privacy violations
• AI can still help with analysis

Anti-Patterns / Misuse Risks

Misuse Risk 1: "It's Just a Little Information"

"I'll share just one name and some feedback. That's probably fine."

Why it fails: Even a little identifying information reduces privacy. Names are enough to identify.

Misuse Risk 2: Assuming Internal Tools Are Safe

"This is our internal AI tool, so I can share anything."

Why it's risky: Even internal tools should follow data governance. Check your organizational policy.

Misuse Risk 3: Using Free Tools for Sensitive Data

"I'll just paste this confidential information into the free AI tool. No one will know."

Why it fails:

• Free tools often use input for training
• You're sharing confidential information with the tool provider
• It's a breach of trust and confidentiality
• Legal risk

Misuse Risk 4: Not Thinking About Data Lifecycle

"I've shared something with AI. Now I'm done."

Why it's risky: Data doesn't disappear. It may be stored, logged, or used for training.

Human Judgment Checkpoints

Before sharing anything with AI, ask:

1. Would I be comfortable if this became public? If no, don't share.
2. Does this identify a specific person or customer? If yes, anonymize first.
3. Is this proprietary to my company? If yes, use only approved tools.
4. Is this confidential? If yes, don't share with external tools.
5. Have I checked my organization's policy? If uncertain, ask before sharing.

Responsible AI Considerations

Understanding Data Governance

Different organizations have different policies. Know yours. If uncertain, ask.

Protecting Others' Data

You're a steward of your team's data, customer data, and company information. Protecting it is your responsibility.

Being Transparent With Your Team

If you're using AI on team-related information, your team should know and should trust you're protecting their privacy.

Personal Accountability

When in doubt, don't share. Your judgment call could prevent a privacy breach.

Practice / Reflection Prompts

1. Policy Check: What is your organization's policy on AI and sensitive data? Do you know where to find it?

1. Your Data Audit: What sensitive information do you regularly work with? How will you protect it with AI?

1. Scenario Practice: For each of the four case studies, rewrite as an anonymized version you'd feel comfortable sharing.

1. Personal Boundaries: What's your personal rule? What will you never share with AI?

1. Team Communication: How would you explain to your team that you're using AI without violating their privacy?

1. Escalation: If you're uncertain whether something should be shared, who would you ask?

Key Takeaways

1. Understand information categories. Public, proprietary, PII, confidential, anonymized.
2. Use the decision framework. Is it public? Does it identify people? Is it proprietary?
3. Anonymize when possible. Remove names and identifiers.
4. Protect confidential information. Don't share in external tools without approval.
5. Check organizational policy. Rules vary by company.
6. When in doubt, don't share. Protect first, ask later.