How to Write AI Prompts Without Leaking Sensitive Data

To use ChatGPT or any other assistant without sharing personal data, the rule fits in one sentence: don't put the sensitive part in the prompt at all. France's data regulator (CNIL) is explicit — an end-user should never enter confidential information (personal data, or data covered by a secret) into a consumer AI service. In practice, you can almost always rephrase the request so it stays useful while containing no name, number or secret: generalize identities, paste only the needed excerpt, separate the data from the task, and re-read the prompt before sending.

Why “paste everything” is the wrong reflex

Pasting the whole document feels simpler, but once the text is sent you control none of it. On a consumer account, the content is processed on remote servers, may be stored by the provider, reviewed by humans to enforce policy or improve the service, and — unless you opt out in Data Controls — used for training. “I'll just delete it after” isn't a reliable safeguard: retention isn't always under your control. In 2025, a preservation order in the New York Times v. OpenAI litigation forced OpenAI to retain ChatGPT logs that would otherwise have been deleted. The only durable protection is to never expose the sensitive value in the first place.

The principle: minimize what leaves your control

The GDPR sets the data minimization principle (Article 5(1)(c)): personal data must be “adequate, relevant and limited to what is necessary.” The UK ICO frames the same idea — process only the minimum personal data needed for each purpose — and draws a very concrete benefit: the less data you hold or expose, the less there is to lose in a breach. Applied to a prompt, this gives a direct rule: don't include personal data “just in case.” Paste only the excerpt strictly useful to the task, not the whole document.

When you need the model to stay consistent (“the client,” “the supplier,” “the project”) without knowing the real identities, replace each direct identifier with a consistent marker — for example “Jean Dupont, +33 6 12 34 56 78” becomes “a client” or “CLIENT_1.” This is the logic of pseudonymization, recognized under the GDPR as a technical measure supporting minimization: you replace direct identifiers with markers and keep the mapping aside, stored separately and securely. The model gets enough structure to do the work, never the real identity.

Six habits for a useful, safe prompt

These techniques turn into writing reflexes. Before every send:

• Generalize: swap precise identities and details for vague terms — a sector rather than a named company, a city rather than a full address (advice the Mozilla Foundation echoes).
• Use consistent, reversible placeholders: CLIENT_1, SUPPLIER_A, AMOUNT_X, keeping the mapping out of the prompt so you can re-insert the real values into the answer.
• Separate the data from the task: describe what you want (“rewrite this payment reminder”) without pasting the recipient's contact details.
• Minimize the excerpt: paste only the passage you need, not the whole file — and don't upload the raw document “to save time.”
• Don't bring in other people's data: avoid entering third parties' personal details (colleagues, clients) you aren't allowed to share.
• Check before sending: re-read the prompt and confirm no name, number, email, address or secret remains in the clear.

These habits aren't only individual. The CNIL recommends providing input templates or pre-prompts that steer users toward well-identified tasks, and making teams accountable through training so they know which categories of data are off-limits before they even open the tool. A shared structure always beats “everyone pastes whatever they want.”

Before / after: the same need, without the leak

The table below contrasts a risky prompt (“paste everything”) with its safe version, for common tasks. The model's answer stays just as usable:

The 5-step routine (and its limit)

To lock in the reflex, always follow the same order before sending a prompt:

1. 1Separate the sensitive data from the task: state the instruction first, then look at what really needs to come with it.
2. 2Generalize identities and precise details (names, contact info, addresses).
3. 3Replace what must stay traceable with consistent placeholders, mapping kept out of the prompt.
4. 4Cut down to the minimal needed excerpt, without uploading the raw document.
5. 5Re-read one last time: no name, number, email, address or secret should remain before sending.

These habits sharply reduce exposure, but they have a limit: they rely on your vigilance, on every prompt, under time pressure. One identifier missed in a long excerpt is enough to reopen the gap. Automation — detect, then tokenize systematically — removes that risk at scale, including the cases a human reader would miss. That's the difference between a good habit and a guarantee. For the full method and tooling, see our guide “How to anonymize your data before using AI”; and to understand why even careful people end up pasting data, “Why careful people paste data into AI.”

That's exactly what ONYRI Sanitize is for: the engine spots names, numbers, addresses and secrets and replaces them with consistent, reversible tokens before sending; detection and the token↔value mapping stay in your browser, and only anonymized text reaches the AI. Your writing habits still matter — the tool makes them systematic, down to the identifier the eye would have let through.