Before you paste that invoice into ChatGPT: a 7-point AI privacy checklist

The quiet leak in every small office

Someone asks an AI to "make this invoice look professional" and pastes the lot: the client's name, address, GSTIN, phone number, bank account and the amount owed. It's fast, and it works. It also hands a third party data that your customer gave only to you.

Most AI apps keep your chats, and some use them to improve their models unless you switch that off. None of this is secret; it's in the settings. The fix isn't to stop using AI. It's to change what you send it.

The 7-point checklist

1. Swap identities for placeholders

Before you paste, replace names, PAN, Aadhaar, phone numbers, emails, addresses and bank details with [CLIENT], [PAN], [PHONE] and so on. Put the real details back in when the text comes out. The AI doesn't need them to write a good email.

2. Turn off training, or use a temporary chat

In ChatGPT, open Settings, then Data Controls, and switch off "Improve the model for everyone". Its Temporary Chats aren't used for training and are deleted after 30 days. Other AI apps have similar switches; find yours once and set it.

3. Never upload ID or signatures

Aadhaar and PAN card scans, cancelled cheques, signed agreements and signature images should never go into a chat. If you need help with a document like that, describe the problem instead.

4. Ask for the format, not the filled-in document

Ask the AI for a template with blanks ("a rent receipt with fields for tenant, landlord, amount and month") and fill in the facts yourself, on your own device. Tools that build documents in your browser keep the facts off anyone's server.

5. Use business accounts for customer work

Business and API plans usually come with stronger data terms than free personal accounts. If your team uses AI on customer data every day, read the plan's data terms and pick one that doesn't train on your data.

6. Keep the most sensitive work on your own machine

Open models now run on an ordinary laptop. For payroll, contracts or anything with ID numbers, a local model means the text never leaves your computer.

7. Write down which tools touch customer data

A one-page list is enough: which AI and online tools you use, what customer data goes into each, and who on your team uses them. You'll want it when India's data protection rules fully apply.

What India's data protection law means for you

The Digital Personal Data Protection Act, 2023 governs how businesses handle personal data about people in India. Its Rules were notified in November 2025 and come into force in phases over 18 months.

The law expects you to protect the personal data you collect and to use it only for the purpose you collected it for. Pasting a customer's details into a tool that may train on them is hard to square with that. The checklist above is a good start; for your specific obligations, ask a lawyer or CA.

Where DocketBee fits

We built DocketBee so documents never leave your device: the form, the preview and the PDF are all made in your browser, and the details you type aren't sent to our servers. Use AI for the wording if you like, then make the invoice, receipt or letter here with the real details.