Someone Pasted Client Data into AI: Contain It in One Hour using ChatGPT

Why this matters

A new hire pastes a client’s payroll export, Social Security numbers and all, into a personal ChatGPT account to get a quick summary. Twenty minutes later he mentions it. Most small offices have no plan, so the next hour goes on panic while the chat sits there.

The first hour decides how bad it gets. With a written plan, it becomes a calm checklist: stop and record, contain it in ChatGPT, then write it down and tell the right people. The client hears about it from you, with times and facts, instead of guessing.

Practice

Do every step yourself in a practice copy of the real tool. It checks your work, and “Do it for me” finishes any step you get stuck on.

ChatGPTSomeone Pasted Client Data into AI: Contain It in One Hour using ChatGPT24 steps · ~9 min · nothing touches your real accounts

Start the practice →Prefer to read? Step-by-step guide

What you’ll build

You are Priya, office manager at Harbor & Pine Bookkeeping (made up). Jordan pasted Hale Dental Studio’s March payroll into ChatGPT and asked it to remember the client. You follow a one-hour incident log, sitting with Jordan at his screen.

You delete the chat, find the memory it left behind and delete only that one, check shared links and turn off training. Then a Temporary chat writes the incident note, the client email and a new policy rule, and you catch the two things it got wrong when we tested it.

What you need

Nothing to start the practiceThe log and ChatGPT are practice copies. Nothing is deleted and nothing is sent.
The incident logDownload it below (CSV), then in Google Sheets choose File, Import, Upload. Keep a blank copy with your AI policy.
For a real incident: the account the data went intoSit with the person who pasted it, on their screen. Never ask for their password.
The owner’s number and your AI policyThe owner hears first. The policy gets the new rule at the end.

Concepts

Deleting the chat is only half of it

ChatGPT memory is stored separately from chats. In our real test, the memory about the client was still in the saved memories list after the chat was deleted.

So after Delete chat, go to Personalization, saved memories, and delete only the memory about the client. Then check Shared links, because a shared link can outlive the chat.

Never repeat the leak to write about it

The incident note describes the kind of data, the times and the steps. It never contains the client’s names or numbers.

Give ChatGPT those facts only, in a Temporary chat. It writes a tidy note fast. Your job is to make it specific: who you will tell, and by when.

Read the client email as the client

In our test, the email to the client said “a saved memory relating to the client”. Small slips like that make an honest email sound careless.

Read every line as the person receiving it, send it yourself after the owner has seen it, and add the new rule to your AI policy the same day.

Do it for real

Now repeat it in your own account. Tick each step as you go.

Print the one-hour checklist below and keep it with your AI policy, before you need it.
On the day: stop, and write down what kind of data went in, when, which tool and which account.
On their screen: open the chat, click the three dots at the top right, Delete, then Delete chat.
Click their name at the bottom left, Personalization, then saved memories. Delete only the memory about the client.
Settings, Data controls: check Shared links (Manage), and turn off Improve the model for everyone. Leave Delete all chats alone.
In a Temporary chat, paste the incident-note prompt from the checklist with the times filled in. Make “who we will tell” specific.
Tell the owner, agree the client email, read it line by line, and add the new rule to your policy.

Downloads

Incident log (CSV)The seven rows from the lesson: time, step, who, done.
One-hour checklist (.txt)Every click path, the things people forget, and the incident-note prompt with blanks.

Quick check

3 questions to check you’ve got it.

1. You deleted the chat with the client data. Is the client data gone from ChatGPT?

Yes, deleting the chat removes everything
Not necessarily: check saved memories too
Only if you also delete all chats

Show the answer

Not necessarily: check saved memories too. Memories are stored separately. Delete the one about the client in Personalization, saved memories.

2. What goes into the prompt for the incident note?

The payroll file, so it is accurate
The times, the steps and the kind of data, but no client details
Nothing, write it by hand

Show the answer

The times, the steps and the kind of data, but no client details. Pasting the client data again would repeat the leak. ChatGPT only needs the facts of what happened.

3. ChatGPT’s note says “we will notify the appropriate parties”. What do you do?

File it as is
Replace it with names and a time
Delete that section

Show the answer

Replace it with names and a time. A plan with no names is no plan. Say who you will tell and by when.

Up next · Module 9

Onboard New Clients Without the Back-and-Forth using Airia

You can contain a leak in an hour. Next, see a guardrail work in practice: an AI assistant for new clients with one rule it must never break, tested with the risky question first.

Start module 9 →