SOMEONE PASTED CLIENT DATA INTO AI: THE ONE-HOUR CHECKLIST
From the Stepthrough lesson "Contain It in One Hour" (learn.ynteractive.com/modules/ai-incident-response)
Print it. Keep it with your AI policy. Fill in the time as you go.

MINUTE 0-10  STOP AND RECORD                                   time: ______
  [ ] No more pasting. Don't close or delete anything yet.
  [ ] Write down: what was pasted (type of data, not the data), when,
      which tool, which account (personal or work), who did it.
  [ ] Tell the person it's handled calmly. Reporting fast is what you want.

MINUTE 10-40  CONTAIN IT IN CHATGPT (sit with them, on their screen)  time: ______
  [ ] Delete the chat: open it, click ... (top right), Delete, Delete chat.
      OpenAI says deleted chats are removed from its systems within 30 days.
  [ ] Check memory: your name (bottom left) > Personalization >
      saved memories. Delete ONLY the memory about the client.
      Deleting a chat does NOT delete its memories.
  [ ] Shared links: Settings > Data controls > Shared links > Manage.
      Delete any link to that chat.
  [ ] Training: Settings > Data controls > Improve the model for everyone > off.
  [ ] Never click "Delete all chats". You only need the one chat gone.
  [ ] Was a file uploaded? Check Library and any Project it was added to.
  [ ] Other tools (Claude, Gemini, Copilot)? Same idea: chat, memory, sharing, training.

MINUTE 40-60  WRITE IT DOWN AND TELL PEOPLE                   time: ______
  [ ] Write the incident note in a Temporary chat. Give the AI the times
      and steps only, never the client data again.
  [ ] Make "who we will tell" specific: names and a time.
  [ ] Tell the owner first. Agree who emails the client, and when.
  [ ] Read the client email yourself before it goes. Check every word that
      talks about "the client" when it is going TO the client.
  [ ] Add one rule to your AI policy. File this checklist with the note.
  [ ] Regulated data (health, financial, government IDs)? Ask your lawyer
      or insurer whether you have notification duties. This checklist is not legal advice.

THE PROMPT TO COPY (no client data in it)
  Write a short internal incident note for my office. Don't ask me for any
  client names or numbers. Facts: [time] a staff member pasted [type of data]
  into [tool and account]. At [time] we deleted the chat, deleted [n] saved
  memory, checked shared links and turned off model training. Use these
  headings: What happened, What we did, Who we will tell, What changes now.
  Keep it under 200 words.

Incident owner: ______________   Filed on: ______________