Data Loss Prevention When Staff Use AI Every Day

Somebody in your business pasted a customer email into an AI tool this week to get help drafting a reply. They were not being careless. The approved path was slower, the customer was waiting, and the tool is genuinely good at that. Multiply it by everyone, daily, and you have a data loss problem that no policy document has ever solved.

Why the old approach does not transfer

Traditional data loss prevention watched files: email attachments, USB drives, uploads. Those are discrete events with clear boundaries, and you can inspect them.

What leaves through a chat window is prose. High volume, continuous, and almost always well-intentioned. Nobody is exfiltrating anything. They are pasting the context needed to get a useful answer, which happens to include a name, an address, and an account number. Same objective as before, considerably harder surface.

Blocking makes it worse

The instinct is to prohibit the tools. It fails predictably, and it fails in the direction that costs you most.

People switch to a personal phone. The behaviour continues, your visibility drops to zero, and you lose whatever productivity the tools were providing. You also signal to your team that you would rather not know, which is not the culture you want when something eventually goes wrong.

This is the same dynamic behind shadow AI: suppression relocates the risk rather than removing it.

What actually reduces exposure

The middle row deserves emphasis. A policy saying do not share confidential or sensitive information tells people nothing, because everyone draws that line differently. Do not paste a customer's full name and address together is a rule someone can follow at speed.

Software can now help

This part is newer than most people realise. Small guard models have become good enough and fast enough to sit between a person and a cloud AI service, flagging or stripping personal information before anything leaves the device.

Perplexity shipped one this week at around 0.6 billion parameters, built for exactly this. The size is the interesting part: small enough to run locally without noticeable delay, which is what makes it usable rather than a checkpoint people route around.

It is not a complete answer. A guard model catches recognisable patterns like names, addresses, and account numbers, and it will miss information that is sensitive because of context rather than format. But this is a real control that did not practically exist for a small business a year ago, and it is worth asking your vendors whether they offer something similar.

The obligation applies whether you approved it or not

Under PIPEDA you stay accountable for personal information handed to a third party, and an AI vendor is a third party. Quebec Law 25 raises the bar further for businesses handling personal information there.

The part worth internalising: that accountability does not depend on whether you sanctioned the tool. Staff using something you never approved still creates your obligation, which is the strongest practical argument against pretending shadow usage is not happening. The wider framing is in keeping AI use PIPEDA-compliant.

Start by asking, not auditing

Before buying anything, ask your team which AI tools they actually use and what they paste in. Ask it in a way that makes honesty safe, because the answer is only useful if it is true.

You will usually learn two things. There are more tools in use than you thought, and the reason is nearly always that the sanctioned option is slower or worse at that specific job. Fixing that is cheaper than any control you could buy, and it makes every subsequent control easier to enforce. The training half of this is covered in what your team actually needs to know, where the short list of what never goes in is one of the four things worth teaching.

Frequently Asked Questions