What Should Collaborators Do if They Use AI Tools With Different Privacy Policies?

What Happens When Research Collaborators Use AI Tools With Different Privacy Protections?

Researchers from three universities are collaborating on a study involving faculty interviews and institutional survey data.

One collaborator uses an institutionally managed AI system under a contractual data-processing arrangement. Another uses a personal generative AI account, while a third relies on a locally deployed language model.

All three systems can perform similar tasks, including summarization, coding assistance, and preliminary text analysis.

However, their data-processing conditions differ. The systems may have different retention periods, administrative access arrangements, subprocessors, and restrictions on how submitted information can be used.

One researcher assumes that because their institution permits a particular AI service, the entire team can use it with shared research data.

Another collaborator disagrees because their institution's data-sharing agreement imposes additional restrictions.

The central question is what research collaborators should do when their AI tools have different privacy policies, particularly when shared research information may be processed under different institutional, contractual, or legal requirements.

How Should Collaborators Resolve AI Privacy Policy Differences?

Evaluating Privacy Differences Across AI Tools in Collaborative Research

Why AI Privacy Policies Matter in Research Collaboration

Research collaborations routinely involve information moving between researchers, institutions, and technical systems.

When AI is introduced, another processing environment may become part of that workflow.

The privacy implications depend on what information is submitted, which service processes it, how the information is handled, and what obligations apply.

For example, asking AI to explain a publicly available statistical concept may involve little confidential research information.

Uploading identifiable interview transcripts introduces a substantially different set of considerations.

Collaborators should therefore evaluate privacy in relation to the actual processing activity rather than assume that an AI tool is universally safe or unsafe.

Privacy Policies Are Not the Same as Data-Processing Agreements

A public privacy policy describes aspects of how an organization handles information under particular conditions.

However, enterprise, institutional, or research-specific arrangements may also be governed by contractual terms, data-processing agreements, and technical configurations.

These documents can establish obligations that differ from those applying to ordinary personal accounts.

For example, an institution may have negotiated particular restrictions on provider use or retention of submitted information.

A collaborator using a personal account with the same product name may not receive identical protections.

The team should therefore examine the actual terms governing each account and deployment.

Which Privacy Differences Should Collaborators Compare?

A useful comparison should focus on processing conditions that could materially affect the research.

Not every factor carries equal significance for every project. The comparison should reflect the sensitivity of the information and the applicable requirements.

Why the Same AI Product May Have Different Privacy Conditions

AI services may be offered through consumer accounts, institutional subscriptions, application programming interfaces, or other deployment arrangements.

Different configurations can involve different contractual terms and administrative controls.

For example, a university-managed service may have documented processing restrictions that do not apply to a collaborator's independently purchased account.

Conversely, some protections may depend on technical settings or institutional configurations rather than subscription labels alone.

Researchers should not infer privacy guarantees from the product name.

Current provider documentation and the applicable institutional agreement should be examined before processing restricted information.

Tool Approval Does Not Automatically Authorize Every Dataset

An institution may approve an AI service for educational or administrative purposes while restricting its use with confidential research information.

For example, the system may be authorized for public literature exploration but not for identifiable participant interviews.

The approval may also be limited to particular accounts, departments, or processing purposes.

Collaborators should confirm that the specific research activity is covered.

Permission to use a tool and permission to process a particular dataset are distinct decisions.

Why Shared Data Can Create Shared Obligations

A collaborative dataset may be governed by participant consent, research ethics approvals, institutional agreements, or contractual restrictions.

These obligations may limit what individual collaborators can do with the information.

For example, one researcher may have access to interview transcripts for an approved analysis but lack authority to transfer them to an external AI service.

The fact that another institution permits a similar service does not necessarily change that restriction.

Researchers should examine who controls the data, which processing activities are authorized, and whether additional approval is required.

The agreement should address the shared research information rather than focus exclusively on individual preferences.

How Should Research Teams Handle Different Institutional Requirements?

Collaborators may operate under different information-security policies and research governance arrangements.

One institution may require an approved enterprise environment, while another permits certain external services subject to safeguards.

The team should identify which obligations apply to the proposed data flow.

Where requirements conflict, researchers should seek clarification from the relevant institutional authorities.

A practical solution may involve an authorized shared environment or a division of tasks that prevents restricted information from entering unsuitable systems.

The related issue of conflicting institutional AI policies in collaborative research requires attention to the authority and scope of each rule.

Why the Strictest Policy Is Not Always a Complete Decision Rule

Research teams may assume that they should simply follow whichever AI privacy policy appears most restrictive.

This can be a useful precaution in some circumstances, but it does not automatically resolve the governing obligations.

Different policies may regulate different activities, information categories, or institutional roles.

For example, one policy may restrict external transfers while another requires particular retention or audit arrangements.

These requirements may not be reducible to a single ranking from strictest to least strict.

The team should determine whether the proposed workflow satisfies every applicable obligation rather than merely selecting the policy that appears most demanding.

What Role Does Participant Consent Play?

Research participants may have been informed about how their information would be collected, stored, analyzed, and shared.

Introducing a new AI processing environment may raise questions about whether the proposed use falls within those arrangements.

However, the need for additional consent or protocol modification depends on the research context and governing requirements.

Researchers should consult the approved protocol and relevant institutional authority before materially changing processing arrangements.

Consent from a collaborator or principal investigator does not automatically replace permissions required from participants or institutions.

Can De-Identification Resolve Privacy Policy Conflicts?

Removing direct identifiers may reduce the risks associated with AI processing.

However, de-identification does not automatically eliminate confidentiality obligations or re-identification risks.

For example, a transcript describing an unusual institutional role may remain attributable to a participant even without a name.

Some research agreements also restrict processing of information that is not directly identifiable.

Collaborators should therefore assess whether the transformed information is genuinely suitable for the proposed system.

Data minimization and de-identification are safeguards, not substitutes for establishing authorization.

What About AI Tools That Retain Conversation Histories?

Some AI systems retain user interactions, while others offer configurable retention or temporary processing arrangements.

The precise conditions depend on the service and applicable account settings.

Research teams should determine whether retention is compatible with their research data-management obligations.

For example, an approved protocol may require particular restrictions on access or retention of participant information.

A provider's retention arrangement may be incompatible with those requirements.

Researchers should not assume that deleting a conversation from the interface necessarily removes all information previously processed.

Does a Promise Not to Train on Research Data Resolve Every Concern?

No.

A provider commitment not to use submitted information for model training may address one processing concern.

However, other questions remain relevant, including retention, security, access, subprocessors, processing locations, and contractual obligations.

For example, a system may exclude submitted material from model training while retaining certain information for operational or security purposes under its terms.

The team should evaluate the complete processing arrangement rather than treat one privacy feature as proof of comprehensive confidentiality.

Actual provider conditions should be verified for the relevant service configuration.

Are Locally Deployed AI Models Always the Safest Option?

Local deployment may reduce certain external data-transfer risks.

However, local operation does not automatically establish adequate security or institutional compliance.

A locally deployed model may still store prompts, expose information through shared infrastructure, or lack appropriate access controls.

Its security depends on administration, configuration, logging, storage, and the surrounding technical environment.

Researchers should evaluate local systems using the same principles of authorization and risk assessment applied to external services.

Where an institution has an approved local environment, it may offer a suitable alternative for some restricted tasks.

How Should International Data Transfers Be Evaluated?

International collaborations may involve data processing across national boundaries.

Different jurisdictions may impose requirements concerning personal information, transfers, contractual safeguards, or research data governance.

For example, the European Union's General Data Protection Regulation establishes rules concerning personal data processing and transfers when it applies.

In the Philippines, Republic Act No. 10173 and its implementing framework establish obligations concerning personal information processing.

The applicability and interaction of these requirements depend on the organizations, individuals, information, and processing activities involved.

Researchers should seek appropriate legal or institutional guidance rather than assume that one country's requirements automatically govern every collaborator.

The broader challenge of AI governance across international research collaborations may require formal data-sharing and processing arrangements.

What If Collaborators Use AI Through Connected Applications?

AI systems may integrate with cloud storage, document platforms, research repositories, or other services.

These integrations can introduce additional information flows.

For example, an AI assistant connected to a shared document repository may retrieve research material beyond the document initially mentioned in a prompt, depending on its permissions and operation.

Collaborators should establish which information the integration can access and whether that access is authorized.

Permission to use the original document platform does not automatically authorize every connected AI service.

Access controls and integration arrangements should be reviewed before sensitive material is exposed.

Should Research Teams Standardize on One AI Tool?

Using one approved system may simplify documentation, technical support, and governance.

However, standardization is not always necessary or practical.

Different collaborators may require specialized tools for programming, literature exploration, or language assistance.

The important question is whether each processing arrangement is appropriate for the information and task.

Teams should select an arrangement that satisfies the applicable requirements rather than assume uniform software use is inherently safer.

How Should Collaborators Document Approved AI Processing?

A useful record should identify the AI system, authorized task, relevant information category, processing arrangement, and responsible researcher.

Where appropriate, it may also identify the institutional approval or agreement supporting the activity.

The record should be proportionate to the significance of the processing.

For example, processing identifiable participant data may require more detailed documentation than using AI to explain a public statistical concept.

Documentation should itself be stored securely when it contains restricted information.

A shared research team AI-use agreement can establish these expectations before processing begins.

What If a Collaborator Already Uploaded Restricted Data?

The team should determine whether the processing was authorized and whether an information-security or research ethics incident may have occurred.

Relevant facts include what information was submitted, which system received it, the applicable account configuration, and the provider's processing conditions.

The responsible institution's incident-response procedures should be followed promptly.

Depending on the circumstances, authorized personnel may need to consider containment, provider contact, notification, or other corrective action.

Deleting a visible conversation does not necessarily establish that all processed information has been removed.

Researchers should not conceal an unauthorized transfer merely because no immediate harm is apparent.

Who Should Resolve Privacy Policy Disagreements?

Research teams should identify who has authority to approve particular processing arrangements.

The principal investigator may coordinate the decision, but their approval does not necessarily override institutional data-protection or research ethics requirements.

Information-security personnel, data-protection officers, research ethics committees, and institutional legal offices may have relevant responsibilities.

When multiple institutions are involved, coordination may be necessary to establish a compliant shared arrangement.

The decision should be documented where it materially affects research processing.

Researchers should not rely on an AI-generated interpretation of legal or institutional requirements as the final authority.

Why Privacy Compliance and Scientific Accuracy Are Separate

An AI system may process information through an authorized arrangement while producing inaccurate analyses.

Conversely, an accurate output may have been generated through unauthorized processing.

These are distinct concerns.

Research teams should establish both appropriate data governance and scientific verification.

For example, an authorized AI-generated statistical script still requires testing before its outputs are accepted.

Privacy safeguards do not automatically establish research validity, and useful results do not retroactively authorize restricted processing.

How Should Privacy Arrangements Be Reviewed Over Time?

AI services, contractual terms, institutional requirements, and research activities may change.

A tool approved for preliminary literature exploration may later be proposed for processing participant-level data.

That change requires reassessment of the actual processing purpose and information sensitivity.

Teams should also review arrangements when provider terms or technical configurations materially change.

The objective is to maintain an accurate understanding of authorized processing throughout the project.

Privacy review should therefore be linked to meaningful research milestones rather than treated as a one-time administrative exercise.

Resolving Different AI Privacy Arrangements in a Three-University Study

The example illustrates why researchers should not resolve privacy disagreements simply by selecting the most familiar AI product.

The appropriate arrangement depends on the actual data flows and obligations governing the collaboration.

Misconceptions About Different AI Privacy Policies in Research

How to Resolve AI Privacy Policy Differences Before Sharing Research Data

Research collaborators should evaluate the proposed processing arrangement before transferring shared information to AI systems.

The decision should be based on documented requirements and actual provider conditions rather than assumptions about product reputation or convenience.

Map the Data Before Comparing Tools

Identify which information will be submitted, who controls it, and what obligations govern its processing.

The sensitivity of the research material should guide the assessment.

Compare Actual Processing Terms

Examine the relevant account configuration, retention, provider access, contractual protections, and connected services.

Do not rely exclusively on general marketing claims.

Obtain Institutional Clarification

Consult the responsible research ethics, data-protection, or information-security authorities when requirements are unclear or potentially conflicting.

Document the Authorized Arrangement

Record the approved systems, processing purposes, data categories, and responsibilities.

Communicate restrictions to all collaborators who may handle the shared information.

Review Arrangements When Conditions Change

Reassess authorization when new AI tools, different datasets, provider terms, or research activities materially change the processing.

Are Your Collaborators' AI Tools Appropriate for Shared Research Data?

Common Questions About AI Privacy Policy Differences in Research

Agree on Authorized Data Processing, Not Merely Preferred AI Tools

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.