Skip to main content

Coaching — Internal Confidential Documents

Why it's risky​

Confidential documents are non-public materials whose disclosure breaches confidentiality obligations: HR records, performance reviews, salary data, internal investigations, legal correspondence, board minutes, security incident reports, vendor contracts under NDA, customer support tickets containing PII or PHI.

Sending these to a public LLM means:

  1. NDA / contractual breach — most enterprise contracts include confidentiality clauses. Pasting a vendor's pricing into ChatGPT may technically breach the underlying agreement.
  2. Employee privacy violation — HR data falls under stricter protection than general PII (GDPR special-category data, French Code du travail confidentiality of medical info, US HIPAA).
  3. Litigation discovery exposure — anything pasted into an external service may become discoverable in legal proceedings; the search history is rarely under your custody.
  4. Cross-organisation contamination — confidential docs about employees, customers or partners affect parties who have not consented to LLM processing of their information.

Examples​

"Summarise this 360-review for Sarah Martin, including ratings on
 leadership, communication and technical depth, plus her salary delta
 vs. peer band..."
"Help me draft a response to this NDA-protected RFP from BigCustomer Corp,
 attached is their full requirement matrix..."
"Triage this customer support ticket — patient John Doe, DOB 1972-03-04,
 hospital ID 4421, complaint about treatment plan..."

Best practice​

  • Default to "is this redactable?" — if you can answer the question with names, IDs, dates and numbers redacted, do that.
  • Class shift — describe the kind of document, not its contents. "I have an HR document outlining a manager-employee feedback session — what tone-softening techniques apply?"
  • Use sanctioned tooling — your HRIS, CRM and ticketing systems have AI features under contract; use those instead of the public consumer LLM.
  • Special categories require extra care — health, biometric, religious, sexual, political, union data is GDPR special-category and almost never appropriate for any external AI.

Alternative phrasing​

❌ Risky:

"Draft talking points for terminating Sarah Martin (employee 4471) after her PIP failed — she missed 3 of 5 milestones and her last performance score was 2.1/5."

✅ Safe:

"What are best-practice talking points for an empathetic, legally-compliant termination conversation in France for a manager whose PIP did not succeed?"

References​