Choose only the data needed for the task, then check whether you are allowed to send it to the AI service you plan to use. For an introductory workplace exercise, start with fictional material that contains no real personal information or confidential business details. Removing a name or turning off model training does not, by itself, establish permission to upload the source file.
This is a practical guide to selecting inputs for AI training and automation. It does not report a customer engagement or a security assessment. Official sources were checked on October 19, 2026. The selection table and exercise process below are DMS.Labs design proposals, not a substitute for your organisation's policies, contracts or applicable legal review.
Define the exercise before choosing a file
Suppose learners need to extract action items from meeting notes. They need enough context to identify the owner and deadline of each task. They do not necessarily need a customer's real name, contact details or negotiated prices. A short fictional note can include an absent owner or a conflicting date without exposing the original meeting record.
Write down the behavior you intend to assess. For example, the learner's AI should extract only actions stated in the note and mark an unstated deadline as unknown. Remove candidate information that plays no role in that exercise. Check whether the reduced material still supports the task, then put the necessary content into a separate practice copy.
The input section of a one-page job sheet can describe which material is permitted, not just name a file. It might allow a particular section of a public manual or an internally approved exercise copy. Check access to the original and permission to transmit it separately. Being able to open a document in a shared company folder does not establish permission to send it to an external AI service.
A short practice sheet on a window-lit desk, separate from a closed source folder.View original
What belongs in a data selection record?
Keep the purpose and required content alongside the transmission permission and retention conditions. The table is an exercise preparation aid, not a legal classification scheme. If a document's status is unclear, hold it back and use fictional material that supports the same learning objective.
Scroll horizontally to view a wide table.
| Material | Preparation approach | What to record |
|---|---|---|
| Public official manual | Select the relevant passage and check usage terms | Source, edition and permitted use |
| Independently written fictional note | Check that no real person or event has slipped in | Fictional label and exercise conditions |
| Business document with names removed | Review remaining identification clues | Residual clues and transmission approval |
| Customer or employee data, contractual secrets | Hold until the basis and environment for processing are approved | Reviewer and reason for the hold |
| Passwords, verification codes or secret keys | Exclude from educational inputs | A substitute that contains no live value |
Public availability does not settle every question about reuse. A document can be visible online and still contain personal information or have restrictions on copying and redistribution. Select a relevant passage, retain the source and check its terms. If permission remains unclear, write an independent example instead.
Avoid turning the review record into another copy of the sensitive content. Use an internal identifier that helps the reviewer locate the document, plus its approval status. Do not paste a contact number or live secret into the explanation of why it was withheld. Restrict access to the review record as well.
Is removing names enough?
Not on its own. A job title, the date of an unusual event or a distinctive work history may still identify someone. Review the meaning of free-text notes as well as obvious identifiers such as names and contact details.
The UK's Information Commissioner's Office distinguishes pseudonymisation from anonymisation. Information that can be linked to a person using separately held additional information remains personal data under the UK framework it describes. The ICO page also says the guidance is under review. Use the distinction to avoid treating a name replacement as completed anonymisation; do not treat it as a determination of compliance for a Korean organisation.
A hypothetical example illustrates the problem: replacing an employee's name with Participant A may leave a sentence identifying that person as the only specialist at a particular branch. This is not an instruction to find real employee records and test whether they can be re-identified. When preparing a first exercise, consider writing independent fictional sentences that preserve the task structure without requiring a mapping back to actual people.
Include other spreadsheet tabs, document comments, revision history and the edges of screenshots in your review. Check whether text covered on screen is still available when copied, and reopen the actual file intended for upload. These are practical checks for avoidable omissions, not a guarantee that every hidden element in every file format has been removed.
Does no training mean no retention?
Training use and data retention are separate conditions. OpenAI says it does not train models on business product and API inputs and outputs by default. Its API documentation separately describes abuse monitoring logs and application state stored to deliver particular features. Default monitoring logs may be retained for up to 30 days, subject to the exceptions stated in the documentation. Individual features have additional storage conditions.
Do not extend that statement to every personal AI account or another provider's products. Check the product, plan, feature and settings you will actually use. Special retention arrangements should not be assumed to apply automatically to your organisation or every feature. This guide has not inspected a particular reader's contract or account configuration.
On May 19, 2026, Korea's Personal Information Protection Commission announced a privacy guide for users of generative AI. Its announcement addresses training opt-out, conversation storage and deletion settings, workplace inputs and connections to external services as distinct concerns. The announcement was inspected for this article; the attached guide was not reviewed in full.
When choosing an educational tool, record the actual account category, upload feature and connected services alongside its name. Map the destinations beyond the first AI service, including automation tools and storage. A promise from the original provider does not establish how an external service receiving the data will handle it.
Hands checking a blank review sheet against practice material beside a closed laptop.View original
How should a practice copy be checked?
Before upload, a person should compare the final file with the exercise conditions. For meeting-note extraction, check whether the task asks for contact details the note does not contain and whether the fictional dates and owners are internally consistent. If removing sensitive material has made the task meaningless, consider rewriting the fictional exercise rather than adding more of the real source.
Assess the output separately. A simple fictional case may not test the exceptions found in operational work. Specify the conditions learners should handle, such as an absent owner or conflicting schedule, and write down how an incorrect answer will be judged. Acceptance tests for an AI skill cover the next step: evaluating what the system produces. Passing a fictional exercise does not authorise the processing of real personal information.
Keep the approved practice version, its purpose, checked settings and unresolved items in the review record. Revisit the permission scope when the source changes or a new external connection is added. If real information appears unexpectedly during practice, stop further transmission and follow the organisation's incident response process. Do not report that every transmitted copy has disappeared merely because a conversation was deleted from the visible interface.
Prepare the practice copy in an environment your organisation permits. Uploading an original document to an external AI and asking it to remove personal information transmits the original before the cleanup begins. If that transmission is not permitted, use approved internal tools or manual preparation, or choose fictional material that does not depend on the source.
Distinguish independent fictional writing from lightly editing an actual record. Changing a contract's dates and prices can leave context that identifies its counterparty or project. If the exercise needs an absent task owner, consider putting that condition into an unrelated invented work situation. A person should still review the fictional copy for accidental links to actual people.
In a group session, agree on the permitted inputs for participants as well as the instructor. An approved exercise does not cover a learner uploading a separate work file. State which files are allowed, when additional uploads must wait and what may appear during screen sharing. Review only screens and files you are authorised to inspect.
Decide who will keep the practice files and outputs after the session. Outputs may repeat input content, so submission folders and shared results need appropriate handling too. Follow the organisation's actual storage and retention policy; this guide sets no arbitrary period. A deletion record should name the locations and scope checked, without implying that copies at other services were also verified.
Where to go next
DMS.Labs practical AI education describes its approach to task definition and guided practice. The service page is in Korean. Preparation can begin with one task, practice material containing no real sensitive information and clear conditions for withholding an input. A real customer document is not a prerequisite for starting the learning exercise.