Skip to content
QDNALearn AI, from beginner to expert
FR

Lesson 6 · Beginner · 15 min

Privacy and company data: workplace rules before prompting

Secure your data in Gemini: GDPR rules, trade secrets, and Workspace Enterprise protection. What gets trained on and what stays confidential.

By QDNA · Published on · Updated on

Goal
You will recognize sensitive data boundaries and effectively redact documents before submitting them to Gemini.
Skills
Check
Privacy and company data: workplace rules before prompting
Illustration generated by AI

Your first attempt, unaided

Take an invoice or internship agreement and list the five personal or proprietary details you must redact before prompting an AI.

In brief.

Before pasting any document into Gemini, apply the three-point sensitivity test: does it contain personal identifiers (GDPR), trade secrets (margins, code, proprietary strategy), or confidential personnel disputes? On free accounts, thorough anonymization is mandatory. On Google Workspace Enterprise, proprietary data remains contractually protected, yet responsible workplace discretion remains best practice.

  1. 1The three-threshold sensitivity filter

    Three categories of workplace data to never paste raw encompass personal identifiers, trade secrets, and sensitive dispute records. Enforcing strict pseudonymization protocols neutralizes regulatory liability and prevents competitive exposure.

    Even within contractually secured enterprise environments, sound operational risk management requires sanitizing documents before submission to AI systems. Personal data (GDPR) exposes companies to severe regulatory penalties if improperly disclosed. Proprietary manufacturing secrets, customer pricing, and mergers represent vital intellectual capital. Finally, personnel disputes and internal investigations require heightened discretion. Replacing names with generic roles and exact financial figures with normalized bands preserves Gemini analytical power without exposing assets.

    Data category Concrete workplace examples Primary risk Recommended protective technique
    Personal data (GDPR) Names, payroll IDs, salaries, emails Regulatory fines and privacy violations Systematic pseudonymization (« Employee A »)
    Trade secrets Pricing formulas, code, contract discounts Loss of competitive advantage Replace with percentage indices or ranges
    Sensitive disputes Severance notes, customer litigation Legal procedural defects and leaks Anonymize entities and distinctive incident details
    Diagram 'Before pasting text: three questions': Personal data? (name, email, health, salary); Confidential data? (contract, pricing, trade secret); Sensitive decision? (HR, legal, medical); Anonymize or do not use Gemini; Go ahead, then verify answer. Note: Your organization's policy always prevails.Diagram 'Before pasting text: three questions': Personal data? (name, email, health, salary); Confidential data? (contract, pricing, trade secret); Sensitive decision? (HR, legal, medical); Anonymize or do not use Gemini; Go ahead, then verify answer. Note: Your organization's policy always prevails.
    Diagram 'Before pasting textDiagram generated by AI and reviewed

  2. 2Redacting a job description and a wage dispute memo

    Pseudonymizing an HR dispute file before legal review demonstrates that language models perform flawless statutory analysis without ever needing access to real employee identities.

    An employment relations specialist wants to audit a proposed termination agreement against statutory notice requirements.

    Weak prompt.

    Here is the mutual termination dossier for Marc Lambert, sales lead at BioPlast Toulouse: review the interview summons letter and confirm if deadlines comply with labor rules.

    The prompt reveals an employee full name, corporate title, employer, and geographic city, generating a major personal data leak.

    Strong prompt.

    Act as an employment law specialist. Review the attached mutual termination summons where all identifying data is sanitized (Company X, Employee A, notice served on Day -15). Check statutory cooling-off compliance and list the 3 mandatory clauses to verify.

    The difference. Statutory reasoning and timeline verification execute with identical precision, while the employee privacy and the company confidentiality remain completely protected.

  3. 3Cleanse a contract excerpt before submission

    Build a sanitized briefing memo for safe AI processing to develop the instinctive reflex of stripping sensitive identifiers before submitting any business task to Gemini.

    Select an internal project note or client exchange. Draft a sanitized copy where personal names, exact dates, and financial sums are replaced with generic labels (Client Alpha, Project Beta, Amount M). Submit this version to Gemini.

    Run this prompt:

    'Based on the sanitized briefing below regarding Project Alpha and Partner B, summarize the three identified contractual liabilities.'

    Self-evaluation rubric: (a) all personal names and company identities are removed ; (b) exact monetary figures are neutralized ; (c) the underlying logical structure remains intact for high-quality Gemini analysis.

    Open the prompt composer

  4. 4Partial redaction by merely removing employee surnames

    Assuming pseudonymized files lose analytical precision misunderstands how generative AI operates, as models reason over semantic relationships rather than proper personal names.

    Some professionals avoid AI out of data leakage fears, while others recklessly paste raw contracts arguing that sanitization destroys meaning. In reality, Gemini needs no real names to assess a three-week delivery delay and draft an enforceable liquidated damages clause.

    Fix: sanitize documents by substituting functional roles ('IT Vendor', 'Public Buyer') rather than deleting sentences.

    Rule to remember: artificial intelligence analyzes semantic logic and causal relationships, never the real-world identities of individuals.

  5. 5Quiz

    Three questions, instant feedback. Each option comes with an explanation.

    1. You must summarize team performance reviews using consumer Gemini. What should you do?

    2. Why is writing 'Mr. M., Logistics Lead in Bordeaux' an insufficient redaction?

    3. What authority takes ultimate precedence before using AI tools at work?

  6. 6Proof of mastery

    Present a document excerpt before and after rigorous pseudonymization, detailing the exact data classes redacted to safeguard the firm.

    Beginner badgeThis lesson counts towards the Beginner badgeSee the four badges

    Criteria

Going further

Explore the glossary definitions for confidential data, personal data, and pseudonymization. This completes Level 1 (Beginner). Level 2 (Intermediate) begins with Iterate with Gemini: steering responses without starting over, followed by heavy document processing in Analyze a PDF or document with Gemini.

Frequently asked questions

Which data is prohibited in free Gemini?

Personal data (health records, private contacts, salaries), trade secrets (margins, unfiled patents, passwords), and information covered by legal confidentiality.

Does Google Workspace shield you from accidental leaks?

Workspace blocks model training on your data, but does not waive GDPR obligations: never paste personal data without a legitimate business purpose.

How do you effectively pseudonymize text?

Replace names with generic tags ('Employee A', 'Vendor X'), remove phone numbers, postal addresses, and exact financial figures.

Sources