Data protection, explained simply
Data protection means knowing where your secrets are, and stopping them walking out of the door without stopping people working.
The big idea
Every organisation keeps things that must not get out: customers' details, medical records, plans, passwords. Data protection starts with knowing where those things are, a bit like knowing which drawers hold the important papers.
Then you watch the ways out. For years those were email, uploads to websites and memory sticks, and tools called DLP, short for data loss prevention, learned to spot a sensitive file leaving by one of those routes and stop it.
AI chat assistants opened a new way out. Someone pastes a paragraph of a customer's details into a chatbot to get help writing a letter, and the data has gone somewhere nobody was watching. It is not a file and it does not look like an email, so the old tools miss it.
Data used to leave by email, upload or memory stick, and data loss prevention (DLP) guards learned to stop it there. Pasting into an AI chat is a new way out that the old guards do not watch.
Banning AI does not work: people just use it on their own phones, where nothing is watched at all. What works is giving them a safe AI to use, checking what goes into it as well as what is sent by email, and a short, clear list of things that must never be pasted in.
Banning AI does not close the gap. People use it on their own phones instead, where nothing is watched at all.
Pick an approach to watch where the data goes.
Words you will meet
- Sensitive data: information that would cause harm if it got out, such as personal details or secrets.
- DLP: data loss prevention, tools and rules that spot sensitive data leaving and stop it.
- Label or classification: a tag on a document saying how sensitive it is, such as public or confidential.
- Prompt: what you type or paste into an AI assistant.
- Sanctioned: approved by the organisation for work use.
The field notes, in plain words
- DLP after generative AI: the leak is now a prompt
Secrets used to leak by email or memory stick; now they leak when someone pastes them into an AI chat, so give people a safe AI to use instead of banning it.
Ready for more? Data protection: where things stand
Personal work and my own view, not my employer's. Sources are public.