What should I never paste into ChatGPT if I run a small business?

This is the fastest way for a small business to create a real problem out of nothing, and it usually happens innocently: pasting a whole customer email thread to get help replying, or dropping a spreadsheet in to get it cleaned up.

The hard line is personal information about identifiable people. Customer names with addresses or phone numbers, anything about their health or finances, employee records, and anything under a confidentiality clause. Banking and card details never, under any circumstances, for any reason.

The point people miss is that pasting it does not transfer the obligation. Under Canadian privacy law you are still accountable for personal information you were entrusted with, including where you sent it. A free consumer tool is not a vendor you have an agreement with.

The practical fix is small: strip identifying details before you paste. "A customer" instead of a name, "their address" instead of the address. You almost never need the real details to get a good answer — the model is helping you with the wording, not the identity.