Confidentiality, Privilege & Data Privacy: Safe Inputs
Confidentiality failures are among the highest-impact AI risks in legal work. The safest approach is to assume that anything you paste into an unapproved tool could be stored, logged, or seen by others.
First principles
- Use firm‑approved AI tools for any matter-related work.
- Practice data minimization: provide only what the tool needs.
- Prefer sanitized summaries over raw client documents.
- Never paste privileged/confidential material into a public AI chatbot.
A confidentiality‑first data flow
{{UPLOAD_ASSET:confidentiality_data_flow.png}}

What counts as “sensitive” in AI prompts?
- Client names, addresses, identifiers, account numbers
- Case strategy, settlement posture, privileged communications
- Trade secrets, proprietary business information
- Health information (PHI), minors’ information
- Anything covered by protective orders or privacy statutes
Activity: rewrite a prompt to sanitize inputs
Take a prompt you might use for summarizing facts. Rewrite it to:
- Remove names and identifiers (replace with “Client A,” “Vendor B”).
- Remove strategy and privileged communications.
- Include only the facts needed for the task.