How common is it for employees to put personal data into AI tools?

In Cisco's 2025 Data Privacy Benchmark Study, nearly 50% of privacy and security professionals admitted entering personal employee or non-public data into generative AI tools.

How do you protect personal information when employees use ChatGPT or other AI tools?

Governance policies matter, but a policy alone relies on every person remembering it. A control that checks each prompt, file and screenshot before it is sent, and blocks or redacts sensitive data, protects information even when someone forgets.

Is investing in data privacy worth it?

Cisco found that 96% of organizations say the returns from privacy investment exceed the costs.

Nearly half of privacy professionals admit putting non-public data into GenAI

Cisco's 2025 Data Privacy Benchmark Study shows why protecting personal information from AI tools is now a core security job, not a nice-to-have.

Summary

In Cisco's 2025 Data Privacy Benchmark Study of 2,600 privacy and security professionals in 12 countries, nearly 50% admitted entering personal employee or non-public data into generative AI tools. 64% worry about sharing sensitive information publicly or with competitors. Policies alone do not stop this, so the check has to happen before data leaves the device.

~50%: admit entering personal employee or non-public data into GenAI tools
64%: worry about sharing sensitive information publicly or with competitors
96%: say privacy investment returns more than it costs
99%: expect to move privacy budget toward AI initiatives

Cisco 2025 Data Privacy Benchmark Study

Each dot is 1%

Nearly 50%

of privacy and security professionals admit entering personal or non-public data into GenAI tools.

01

64%

worry about leaking it to the public or to competitors.
02

63%

say they know GenAI well. It happens anyway.
03

99%

expect budget to shift from privacy to AI.

Figures are as reported by the sources linked below.

The study

Cisco's eighth annual Data Privacy Benchmark Study surveyed 2,600 privacy and security professionals in 12 countries. These are the people whose job is to keep data safe, and they are the ones reporting the problem.

The risk: sensitive data is already going into AI tools

Nearly 50% of respondents admitted entering personal employee or non-public data into generative AI tools. 64% said they worry about accidentally sharing sensitive information publicly or with competitors. If privacy specialists do this, the wider workforce, with less training and tighter deadlines, almost certainly does too.

Once a prompt, spreadsheet or screenshot leaves the device, you cannot take it back. That is why the check has to happen before the data is sent.

Why a policy on its own is not enough

63% of respondents say they are very familiar with generative AI, yet the leaks still happen. Familiarity does not stop a rushed copy and paste. Governance needs enforcement at the point where data actually leaves: the prompt box, the file upload and the pasted screenshot. Cisco's Chief Legal Officer, Dev Stahlkopf, put the principle this way:

"Privacy and proper data governance are foundational to Responsible AI."

Dev Stahlkopf, Chief Legal Officer, Cisco

The budget pressure makes it worse

99% of respondents expect to move resources from privacy budgets to AI initiatives. At the same time, 96% say privacy investment returns more than it costs. Teams are being asked to secure more AI use with the same or less money, so protection that is simple to roll out and needs no babysitting matters.

Trust is built on protecting people's data

Among consumers, 81% of those aware of their country's privacy laws feel confident protecting their data, against 44% of those who are not aware. 86% of respondents say privacy legislation has had a positive impact. Customers and regulators are paying attention to how companies handle personal information, and AI is now part of that picture.

What this means for your team

Assume personal and non-public data is already reaching AI tools.
Check prompts, files and screenshots on the device, before they are sent.
Let each rule block the request or redact the data, so people keep working.
Keep a record of every event so you can show who did what and when.

Inveil is data loss prevention (DLP) for AI. It checks prompts, files and screenshots on each employee's machine before they reach an AI tool, blocks or redacts sensitive data by your rules, and logs every event.

Common questions

How common is it for employees to put personal data into AI tools?: In Cisco's 2025 Data Privacy Benchmark Study, nearly 50% of privacy and security professionals admitted entering personal employee or non-public data into generative AI tools.
How do you protect personal information when employees use ChatGPT or other AI tools?: Governance policies matter, but a policy alone relies on every person remembering it. A control that checks each prompt, file and screenshot before it is sent, and blocks or redacts sensitive data, protects information even when someone forgets.
Is investing in data privacy worth it?: Cisco found that 96% of organizations say the returns from privacy investment exceed the costs.

Source:

Cisco 2025 Data Privacy Benchmark Study press release