The easiest AI mistake is also one of the most avoidable: putting confidential information into a tool without first asking where that information goes. Before your team uses AI with customer, employee, financial or internal data, decide what is allowed and what is not.
First, classify the information
Create three simple groups: public, internal and confidential. Public information can usually be used more freely. Internal information needs judgement. Confidential information such as passwords, bank details, personal IDs, tax credentials, private contracts and sensitive client records should not be pasted into general AI tools by default.
A seven-point AI data checklist
- Do we actually need to send this data to the tool?
- Can names and identifying details be removed first?
- Do we know whether the provider stores prompts or files?
- Can the provider use submitted data to improve its systems?
- Who in our team is authorised to use the tool?
- Can we delete or export the data later?
- Would we be comfortable explaining this use to the person whose data it is?
Remember that AI does not sit outside normal privacy responsibilities
Nepal has a Privacy Act and electronic transaction rules. An AI tool is simply another way your business may process or transmit information. Using new technology does not make confidentiality obligations disappear.
Write a one-page internal AI policy
A small business does not need a 40-page policy. Write down approved tools, prohibited data, who can approve exceptions, how outputs must be checked and what happens if confidential information is sent by mistake. Train the team using real examples.
Be careful with “free” tools
Price is not the only question. Review the provider’s terms, privacy controls and business settings. If a workflow handles sensitive data regularly, consider a business-grade setup with appropriate administrative controls rather than relying on personal accounts.
Frequently asked questions
Is it safe to paste a client PAN or bank statement into an AI chatbot?
Do not do this by default. Use an approved workflow, minimise the data and understand the provider’s data-handling terms before sending confidential information.
Does Nepal have privacy law relevant to business data?
Yes. Nepal has the Privacy Act 2075, among other laws and sector-specific obligations. For a legal interpretation, obtain advice from an appropriately qualified professional.
Official sources & further reading
- Nepal Law Commission — Privacy Act 2075
- Nepal Law Commission — Electronic Transactions Act 2063
- Ministry of Communication and Information Technology — National AI Policy 2082
Technology, product features and rules can change. Check current official sources and the terms of any tool you plan to use.
Want to apply this to your business?
Use the article to understand the idea. For your actual records, workflow or setup, MSBS can help you work through the practical details.