It usually surfaces sideways: an employee self-reports, a manager overhears, or a security review turns up an AI conversation containing customer records. Someone pasted sensitive data into ChatGPT — or Claude, Gemini, or one of hundreds of smaller tools. What now?
Short answer: scope it, contain what’s containable, rotate anything rotatable, assess your notification duties with counsel, document everything, and then fix the class of problem rather than the instance. Here is that sequence in practice.
Hour One: Establish What Actually Happened
Resist the urge to lecture the employee — you need them cooperative, because they hold most of the facts. Establish:
- What data, exactly. “Customer info” is not scopeable. Get the actual text if it still exists in the chat history: which fields, which people, how many records, which systems it came from.
- Which tool and which account. Consumer ChatGPT, a Plus subscription, an enterprise workspace, a personal Claude account? Data-handling terms differ enormously — enterprise tiers typically exclude training and offer retention controls; personal free accounts are the weakest case.
- When, and how often. A single paste last Tuesday is one event. “I do this every week” is a process failure with a much larger exposure window.
Treat the employee as a witness, not a defendant. Organizations that punish self-reporting get exactly one honest report — the last one.
Contain What Can Be Contained
Provider-side controls are limited but not zero. Depending on the tool and tier: delete the conversation, disable chat history and model training where settings allow, and use the provider’s data controls or deletion request processes. For enterprise workspaces, your admin may be able to purge the conversation and confirm retention settings.
Be honest in your incident notes about what this achieves: deletion requests reduce future exposure but cannot prove the data was never cached, logged, or reviewed. Submission is not recallable — which is why the rest of this playbook matters more than this step.
Rotate Credentials Immediately — This One Is Not Optional
If the pasted content included anything that authenticates — API keys, passwords, tokens, connection strings, private keys — rotate now, before the meeting about the incident. Leaked cloud credentials are exploited by automated scanners in minutes-to-hours when exposed; you cannot verify the prompt’s afterlife, so the key is burned. Check the affected services’ usage logs for anomalies since the paste.
Assess the Regulatory Clock — With Counsel
Whether this event is a reportable breach depends on what the data was and where your obligations sit — and this is a judgment for counsel, not a blog post. The analysis differs sharply by regime: health information implicates HIPAA’s breach analysis; EU personal data raises GDPR’s 72-hour supervisory clock; state privacy and breach laws have their own definitions and thresholds; regulated financial data adds sector rules. What counsel will need from you is exactly what Hour One produced: data types, subjects, volume, tool, account tier, and provider terms. The faster your facts, the better your options.
Document Everything
Write the timeline while it’s fresh: discovery, facts, containment steps, rotation actions, legal analysis, decisions and their rationale. If the event later becomes an auditor’s question or a regulator’s inquiry, the difference between “we responded competently” and “we can’t reconstruct what happened” is this document.
Fix the Class, Not the Instance
Here is the uncomfortable statistic hiding in your incident: the paste you caught is rarely the first. The employee did what was fastest, with no guardrail between the clipboard and the submit button — a condition that applies to your entire workforce, today.
Training addresses awareness; it does not survive deadline pressure. The structural fix is a control at the prompt itself:
- Real-time detection of sensitive categories — PII, PHI, credentials, financial data, source code, and your own custom patterns — in every AI interaction.
- Automatic enforcement: block the dangerous, redact the incidental, warn on the marginal, log the rest.
- Visibility across the AI tools you know about and the hundreds you don’t, so the next incident is a dashboard entry, not a surprise.
This is what Blacksight does. The browser extension and endpoint agent scan every prompt locally on the device and enforce your policy before data leaves; the dashboard gives your security team the audit trail this playbook keeps asking for. Prompt text never reaches Blacksight’s servers — the incident-response tool shouldn’t be a disclosure of its own. Deployment takes minutes; the free tier covers 5 devices, which is enough to protect your highest-risk team this afternoon.
The best incident response is the one your successor never has to run.
Frequently Asked Questions
Can OpenAI delete data an employee pasted into ChatGPT?
You can delete conversations and, depending on account settings and tier, opt out of training and limit retention — and enterprise agreements offer stronger controls. But deletion requests cannot retroactively guarantee the content was never logged, cached, or reviewed while it existed. Treat submitted data as exposed and act accordingly.
Is pasting confidential data into ChatGPT a data breach?
It’s an unauthorized disclosure to a third party, and whether it’s a reportable breach depends on the data type and applicable law — HIPAA, GDPR, and state statutes each define thresholds differently. Make that call with counsel, armed with precise facts about what was pasted, by whom, and to which service tier.
How do we stop this from happening again?
Deploy enforcement at the prompt: AI-aware DLP that detects sensitive data as it’s typed or pasted and blocks or redacts it before submission, across the browser and desktop tools. Pair it with a clear acceptable-use policy and a no-blame reporting path — the control handles the pressure moments the policy can’t.