What Should You Do if You Accidentally Enter Confidential Research Information Into an AI Tool?

You Already Entered Confidential Research Into AI. What Now?

You realize too late that the prompt contained participant information. Perhaps you uploaded the wrong manuscript, pasted confidential reviewer comments, submitted an internal proposal, or included a collaborator's unpublished findings in a public AI conversation.

The disclosure has already happened. The useful question is no longer whether you should have submitted the information. It is what you should do now.

The appropriate response depends on what was disclosed, the AI service involved, how the service handles submitted information, and the research, institutional, contractual, ethical, and legal requirements that apply. But one principle is broadly useful: treat the event as a potential information incident and respond promptly rather than trying to quietly make it disappear.

Contain, Document, Assess, and Escalate Promptly

The Goal Is to Reduce Harm Without Destroying the Facts Needed to Assess the Incident

First, stop adding information to the incident

Once you recognize the problem, do not continue the conversation with more confidential information in an attempt to "fix" what happened. Do not upload another version of the file, repeat the sensitive information in a follow-up prompt, or provide additional context unless an authorized incident-response process specifically requires it.

If an automated workflow, connector, shared link, integration, or recurring process is continuing to send information, stop or disable that flow where you are authorized to do so.

Containment begins by preventing the disclosure from growing.

Identify exactly what was disclosed

Incident assessment requires facts. Before details become difficult to reconstruct, record what happened through the appropriate institutional process.

Keep the record factual. An incident log should distinguish what you know from what you are still trying to establish.

Do not destroy the evidence needed to understand what happened

There can be tension between removing sensitive information quickly and preserving enough information to assess the incident. Do not solve that tension by improvising.

If your institution has an incident-response procedure, follow it. The privacy, data-protection, information-security, research-integrity, or legal team may need enough information to determine what was submitted, the affected records, the timing, the AI environment, and what containment actions have already occurred.

You generally do not need to keep unnecessary additional copies of confidential material merely to document the incident. What should be preserved, and how, depends on your institution's procedures and the nature of the event.

Use available deletion or containment controls promptly where appropriate

If the provider allows you to delete the conversation or uploaded file, deletion may be an appropriate containment step. But understand what the control actually does.

OpenAI, for example, currently states that deleting a saved ChatGPT conversation removes it from the user's account view immediately and schedules it for permanent deletion from OpenAI systems within 30 days, subject to stated exceptions such as prior de-identification or security or legal obligations. Files saved separately in ChatGPT's Library may need to be deleted separately from the conversation.

Other services can have different retention and deletion arrangements. Consult the documentation for the exact product rather than assuming that the word "delete" has the same technical effect everywhere.

Check whether the disclosure extended beyond the main AI provider

An AI interaction can involve more than one service. Connected applications, web search, actions, plugins, APIs, organizational integrations, or other external services may receive information during a workflow.

If the sensitive material was transmitted onward, deleting the conversation in the original AI interface may not remove information held by another recipient.

This is why understanding what happens to information after it enters an AI system becomes particularly important during incident response.

Report internally rather than deciding alone that nothing serious happened

A researcher may be tempted to reason: "It was only one paragraph," "I deleted it immediately," or "training was turned off." Those facts can matter to the eventual risk assessment, but they do not necessarily establish that no report is required.

Institutions commonly have designated channels for suspected privacy breaches, information-security incidents, research-data incidents, or research-ethics problems. Depending on the situation, the appropriate contact might include a data protection or privacy officer, information-security team, research office, institutional review board or research ethics committee, data custodian, legal office, principal investigator, or another designated official.

Prompt internal reporting can be especially important because some legal regimes impose short deadlines on organizations once they become aware of a reportable personal-data breach.

Not every AI mistake is legally a reportable personal-data breach

An AI-related research incident and a legally reportable personal-data breach are not synonymous.

You might accidentally upload confidential intellectual property containing no personal data. That could be a serious contractual or research-security incident without being a personal-data breach. Conversely, uploading identifiable participant information to an unauthorized service may implicate privacy and data-protection requirements.

Whether external notification is legally required depends on the applicable jurisdiction and circumstances.

Philippine personal-data breach rules use a risk-based notification threshold

Under the Philippines' Data Privacy Act implementing rules, the National Privacy Commission and affected data subjects must be notified within 72 hours upon knowledge of, or reasonable belief that, a personal-data breach requiring notification has occurred. The mandatory notification threshold includes circumstances involving sensitive personal information or information that may enable identity fraud, unauthorized acquisition, and a real risk of serious harm.

The National Privacy Commission also states that not every personal-data breach requires mandatory notification. Incidents that do not meet the mandatory threshold should still be documented and handled under applicable security-incident requirements.

The important operational lesson for an individual researcher is not to attempt a solo legal determination from memory. Report the event promptly through the responsible institutional channel so the organization can assess its obligations.

Other jurisdictions can impose different reporting tests and deadlines

Under the UK GDPR framework, for example, organizations generally must report a qualifying personal-data breach to the Information Commissioner's Office without undue delay and, where required, within 72 hours of becoming aware of it. High-risk breaches can also require communication to affected individuals.

HIPAA in the United States uses a different framework for breaches of unsecured protected health information. HHS states that an impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the protected health information was compromised based on the required risk assessment or an exception applies.

These examples illustrate why whether an AI-related research privacy incident must be reported depends on the governing framework rather than one universal threshold.

The type of research material changes the response

An accidentally uploaded public journal article presents a very different problem from a file containing identifiable participant health information. Likewise, a confidential grant application, peer-review manuscript, collaborator's unpublished invention, or commercially sensitive dataset can create obligations unrelated to personal privacy.

The response team therefore needs to understand not only how much information was disclosed but what obligations were attached to it.

Changing settings after the event does not retroactively change the original disclosure

Turning off model improvement, switching to temporary chat, or moving to an enterprise account may improve future practice. It does not change the conditions under which the earlier information was submitted.

Likewise, learning afterward that research prompts can have different model-training arrangements is useful for assessing the incident, but changing the setting now cannot retroactively alter how the original interaction was configured.

Contacting the provider may be part of the response

Depending on the incident, your institution may decide to contact the AI provider to clarify retention, request assistance, investigate whether information was transmitted onward, or use available privacy and support mechanisms.

Do not make unsupported assumptions about what the provider can retrieve or erase. Provider capabilities and contractual relationships differ, particularly between personal accounts, enterprise environments, APIs, and institutionally managed services.

Use the incident to improve the research workflow

After immediate containment and assessment, the useful question becomes why the disclosure occurred.

Was the researcher using a personal AI account because no approved institutional service existed? Was confidential information embedded in a document nobody realized contained participant details? Were project rules unclear? Did collaborators have different assumptions about AI? Was there no warning before file upload?

Corrective actions might involve approved-tool lists, clearer data classifications, staff training, technical controls, revised research protocols, or explicit AI provisions in collaboration agreements. Incident response should reduce the chance of recurrence, not merely close a ticket.

You Accidentally Upload the Wrong Interview Transcript

The researcher's job is not to personally pronounce the incident closed. It is to contain it, provide accurate information, and get it into the appropriate assessment process quickly.

Common Mistakes After an Accidental AI Disclosure

Respond Quickly Without Trying to Be Your Own Incident-Response Team

Your immediate role is usually to prevent further disclosure, establish the basic facts, and notify the people responsible for assessing the event. You do not need to determine every legal consequence before reporting the incident internally.

The question of when an AI-related research privacy incident requires reporting should therefore be considered as part of the response, not postponed until every technical detail is known.

After Accidentally Entering Confidential Research Into AI

Questions After an Accidental Research Disclosure to AI

An Accidental AI Disclosure Is a Containment and Assessment Problem

How to Cite This Guide

This guide is intended to be read, shared, and used in research, teaching, and academic work. If you draw on its ideas, explanations, or other content, please acknowledge the source by citing the guide. Doing so gives appropriate credit and helps your readers locate the original resource.