Originally published at https://charz.ai/blog/ai-usage-policy-template by Char-Z AI.
Why Data Handling Needs Rules Specific to AI
Traditional data-handling policies assume you control where data goes. AI breaks that assumption — data entered into a model may be stored, used for training, or passed to subprocessors in ways you cannot easily see (European Commission, 2016). Data-handling guidelines for AI must therefore be explicit about which data may enter which tools, and what must be stripped, masked, or excluded before it does.
The two forces that make this non-optional: GDPR's obligations around processing personal data, and the fact that employees will use AI regardless — so the rules must be practical enough to follow.
A Tiered Data-Classification Framework
A tiered rule is far easier to follow than a long list of prohibitions. Classify data, then apply the tool rule.
Public — includes published, non-sensitive — AI tool rule: any approved tool.
Internal — business data, non-personal — approved tools only.
Restricted — personal, regulated, confidential, health — approved + DPA-backed tools only; often also masked.
Rule of thumb: the higher the tier, the fewer the tools and the more safeguards required.
Making the Tier Decision
Classify based on sensitivity and obligation:
Is it personal data? If yes, GDPR's principles apply — purpose limitation, data minimization, and security (European Commission, 2016).
Is it regulated or special-category? Health, biometric, and other sensitive data carry stricter conditions and should rarely enter models at all.
Is it confidential or commercial? Trade secrets and pre-public material are restricted regardless of regulation.
Applying Safeguards by Tier
Public tier
- No special safeguards. Any approved tool.
Internal tier
Approved tools only.
Strip identifiers before entry where feasible (names, email addresses).
Use company accounts, not personal logins.
Restricted tier
Approved, DPA-backed tools only.
Verify the vendor's data commitments: no training on your data, documented retention, no subprocessor surprises (see our vendor data-flow mapping guide).
Prefer on-device, self-hosted, or enterprise-tier models when available.
Where possible, use synthetic/anonymized data instead of real restricted data.
Obtain an explicit business justification and record it.
The Mask-and-Strip Habit
Before entering data into any AI tool, get teams into the habit of:
Masking identifiers — replace names, emails, phone numbers with placeholders.
Minimizing — enter only what the task requires, not the whole record.
Verifying the tool — confirm it is approved and the vendor commitments are current.
This habit dramatically reduces the volume of restricted data that ever reaches a model.
Handling Special-Category Data
Health, biometric, and other special-category data under GDPR should not be entered into generalized AI tools at all unless a strict, documented exception applies (European Commission, 2016). For genuine needs, use purpose-built, contractually protected systems and involve the data-protection function before proceeding.
Governance and Training
Publish the tiered guidelines, train staff, and make classification the default conversation at intake. Fold the rules into your AI usage policy (see our usage policy template) so employees see a single, coherent set of expectations.
Sources
European Commission. (2016). Regulation (EU) 2016/679 — General Data Protection Regulation. *Official Journal of the European Union*.
NIST. (2023). *Artificial Intelligence Risk Management Framework (AI RMF 1.0)*. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
Top comments (0)