Here Are the 5 Essential Questions to Ask Before Pasting Into AI

Before you paste text into an AI, take thirty seconds. Ask yourself five simple questions. They fit into a single reflex. The most important is the last one: “could I send an anonymized version instead?” If yes, the risk nearly disappears. The first four questions spot what is sensitive. The fifth gives you the fix. Here are the five questions, in order.

The 5 questions at a glance

Here is the ranking, from the first question to the last:

1. 1Does it contain someone's personal data? A name, an email or a number is enough.
2. 2Would I be comfortable if this were kept for years, or read by a human? Both happen.
3. 3Is there a name, an identifier, a number or a secret I can remove? Take it out first.
4. 4Do my employer, my client or the law allow it? If not, don't paste.
5. 5Could I send an anonymized version instead? If yes, do it — that's the ONYRI Sanitize method.

Questions 1 and 2: what your text becomes

The first question has a legal answer, not just a feeling. The GDPR (Regulation (EU) 2016/679) defines “personal data” in its Article 4. It is any information relating to an identified or identifiable person. A name, an identification number, location data, an online identifier: all of it counts. If your text holds one of these, you are handling personal data. It's no longer an impression. It's a legal category.

The second question is a comfort test. Picture your text kept for several years. Picture a person reading it one day. Both are possible. OpenAI states that conversations may be used to train its models, unless you opt out. Its models are built partly from what users provide (see the OpenAI Help Center). And human reviewers may read exchanges to enforce the rules and improve safety. So your text isn't seen by a machine alone.

“Kept for years” is not an exaggeration. In the New York Times v. OpenAI case, a U.S. court ordered OpenAI to preserve its output logs. That included conversations users had deleted, normally erased on a roughly 30-day cycle. In November 2025, the court ordered about 20 million de-identified logs to be produced to the plaintiffs. Bloomberg Law and the National Law Review reported it. So pasted text can stay, then end up before a third party.

Questions 3 to 5: clean, check, anonymize

The third question is practical. Look at your text and hunt for what you can remove. A name, an identifier, a number, an API key, a password. Take it out before you send. One caveat: removing a single name often isn't enough. The ICO, the UK regulator, makes this point. Data is only truly anonymous when no one can be identified, and when the re-identification risk is “sufficiently remote.” So clean every identifier, not just one.

The fourth question is about the rules. Do your employer, your client or the law allow this send? Pasting a colleague's or client's data discloses it to a third party. The GDPR defines that “third party” in Article 4: any body other than you and your processors. In 2023, Samsung banned ChatGPT for its employees. Within about twenty days of use, engineers had pasted confidential source code and internal meeting notes (reported by Forbes). When in doubt, don't paste.

The fifth question is the fix. Could you send an anonymized version instead? Almost always, yes. The ICO describes pseudonymisation this way: replace the information that directly identifies people. You swap a name for a reference number, for example, using techniques like hashing, encryption or tokenisation. That's exactly what ONYRI Sanitize does. Answer “yes” to this question, and the previous four stop worrying you.

How to use them

Make it a thirty-second reflex. Before every copy-paste, run the list:

• Question 1: is there any personal data? A name or a number is enough.
• Question 2: would you be comfortable if it were kept or read? If not, be careful.
• Question 3: remove every name, identifier, number and secret — not just one.
• Question 4: check that your employer, your client or the law allows it.
• Question 5: send an anonymized version rather than the raw text.

Questions 3 and 5 are solved in one move with the right tool. To write prompts without leaking data, read our guide on writing AI prompts without leaks. For the step-by-step method, see our article on how to anonymize data before using AI.

That's the role of ONYRI Sanitize. The engine detects sensitive data and replaces it with reversible tokens before sending. Detection and the token↔value mapping stay in your browser. Only anonymized text reaches the tool. Whatever the model, it finds only tokens — not your real information.