Where Does Your Data Go When You Paste It Into AI?

For most organisations, the honest answer is no.

That isn’t a criticism. AI tools arrived faster than anyone’s data map could keep up. But “we didn’t know” isn’t a position that holds up well with a client, an auditor or the ICO. If personal or confidential data goes into an AI tool, you’re responsible for where it goes next.

A Prompt Is a Data Transfer

It’s easy to think of a chat window as a private notepad. It isn’t. A prompt doesn’t stay on your screen. It’s sent to the AI provider’s servers to be processed, and what happens after that depends on the tool and the type of account it was used with.

Depending on those two things, your data may be:

• Stored, sometimes for days, sometimes indefinitely, sometimes in a country you didn’t choose.
• Reviewed by the provider’s staff, typically for abuse monitoring or quality checks.
• Used to train future models, which is often the default on free and personal plans.
• Passed to third parties, if the tool uses plugins, connectors or integrations that send your data onward.

The same tool can behave very differently on a personal account and an enterprise licence. That’s why “we use ChatGPT” or “we use Copilot” tells you almost nothing about your actual exposure. Which account, with which settings, connected to what? That’s the real question.

The Scale Is Bigger Than Most Teams Assume

This isn’t a hypothetical risk sitting in a policy document. Netskope’s Cloud and Threat Report 2026 found that the number of incidents of users sending sensitive data to AI apps has doubled in the past year, with the average organisation seeing 223 incidents per month. The most common types of data involved are source code (42%), regulated data (32%) and intellectual property (16%). And almost half (47%) of GenAI users are using personal AI apps, giving the organisation no visibility into the type of data shared. cloud and threat report 2026 +2

None of those people are acting maliciously. They’re trying to do their jobs faster. That’s precisely why awareness training alone won’t fix it.

Agents Change the Shape of the Risk

Chat tools only see what someone types in. AI agents are different. They act on your behalf, pulling information from systems like email, SharePoint, CRMs and shared drives to complete a task. That means they can expose data nobody actually typed in.

Ask an agent to “prepare a briefing for tomorrow’s client meeting” and it may read through months of email threads, attachments and internal notes to do it. Every file it can reach is a file that could end up in a prompt, a summary or a third-party system.

Three security issues come with that.

Inherited permissions. An agent usually works with the access rights of the person who set it up, sometimes more. If your SharePoint permissions have drifted over the years (and most have), the agent will happily surface documents that were never meant to be widely seen. Old oversharing becomes new exposure.

Prompt injection. Agents read content from the outside world: emails, web pages, documents. An instruction hidden in that content can redirect what the agent does, including where it sends data. Prompt-injection risks remain unresolved across the industry. This isn’t a bug in one product. scworld

Speed and scale. A person who oversteps their access does it one document at a time. An agent can do it across thousands in seconds.

This is arriving quickly. Gartner predicts 40% of enterprise applications will be integrated with task-specific AI agents by the end of 2026, up from less than 5% the year before. Many will arrive as a feature switched on inside software you already pay for, not as a new purchase anyone signs off. At its 2026 Security & Risk Management Summit, Gartner named the combination that makes agents risky: unreliable reasoning, high agency, access to sensitive data and privileged system access. gartnergartner

The Responsibility Stays With You

Here’s the part that catches organisations out. Using a third-party AI tool doesn’t hand over your obligations. Under UK GDPR, if you decide to put personal data into an AI tool, you remain accountable for that processing. The provider may act as your processor, but questions about lawful basis, retention, international transfers and security still land on your desk.

The ICO’s guidance on AI and data protection makes clear that a DPIA will be required in the vast majority of cases in which an organisation uses an AI system to process personal data. And a DPIA is only as good as the facts underneath it. You can’t assess the risk of a data flow you haven’t mapped. mondaq

Confidential client data adds another layer. Many contracts restrict where client information can be processed and who can see it. A well-meaning summary request can breach that before anyone notices.

Map Every Tool Against Four Questions

The fix starts with visibility. Take each AI tool in use across the business, including the ones nobody formally approved, and answer four questions.

1. What data goes in?
Be specific. Not “documents”, but “client contracts, HR case notes, source code, customer emails”. Include what agents and connectors can pull in automatically, not just what people type.

2. Where is it processed and stored?
Which provider, which region, which account type? Data processed outside the UK raises international transfer questions. A personal account and an enterprise tenant of the same tool can give completely different answers here.

3. How long is it kept?
Check retention for prompts, outputs, uploaded files and logs. Then check whether any of it is used for training or reviewed by people. “Deleted after 30 days” and “retained to improve our services” are very different commitments.

4. What other systems can it reach?
List every plugin, connector, integration and agent permission. This is where data quietly leaves your environment, and where a single tool can become a route into email, file storage or your CRM.

If you can’t answer one of these for a given tool, that gap is your finding. It tells you exactly where to look next.

What the Map Unlocks

A completed map isn’t a compliance artefact to file away. It’s the foundation for the decisions that actually reduce risk.

Accurate DPIAs. Your assessments describe real data flows, not assumptions, so the risks you identify are the risks you actually have.

Stronger supplier contracts. You know what to ask providers for: data residency, retention limits, training opt-outs, sub-processor lists and breach notification terms.

Sensible usage policies. Rules based on real tools and real data types are far easier to follow than a blanket “be careful with AI”.

Targeted security controls. You can tighten permissions where agents are over-privileged, switch off connectors nobody needs, and point data loss prevention at the flows that matter.

Most importantly, it lets AI adoption carry on. Teams that know which tools are safe for which data stop guessing, and stop routing around restrictions they don’t understand.

Where to Start

You don’t need a six-month programme. Start with three steps.

First, build the inventory. Ask each team which AI tools they use, including browser extensions and AI features built into existing software. Expect the list to be longer than you thought.

Second, prioritise by sensitivity. Tools touching personal data, confidential client information or source code go to the top.

Third, check agent and connector permissions early. They’re the fastest-growing source of exposure and the easiest to overlook, because nobody typed anything in.

Once you have that visibility, the everyday habits in our piece on AI governance without the jargon become much easier to enforce. And if you’re already building agents, our introduction to AI agents is a useful primer on how they work under the hood.

Moving Forward

AI tools aren’t going away, and neither is the responsibility that comes with them. The organisations that move fastest with AI won’t be the ones that ignore the security questions. They’ll be the ones that can answer them quickly.

So, a question for CIOs, DPOs and legal teams: could you answer those four questions for every AI tool in your business today?

If the honest answer is “not yet”, that’s a very fixable position. Our AI Governance team works alongside yours to map how data moves through your AI tools, so DPIAs, contracts and policies rest on facts rather than guesswork. And where that needs to sit within a wider plan for your data, our Data Strategy & Governance services help join the two up.