Skip to main content

Data restrictions and security

There are data rules and restrictions on what data you may input into AI tools and how you use the outputs that AI systems generate.

These rules may only be relaxed under exceptional and extremely controlled circumstances, where all the AI processes take place on University-hosted and approved systems explicitly highlighted by IT Services. An appropriate Faculty Research Ethics Committee must authorise the research methodology and any AI processes.

See also: IT Cyber Security guidelines around the use of ChatGPT and AI chat engines

Data that should never be input into AI software

Certain types of data must never be put into any AI software. These include:

  • passwords and usernames
  • personally identifiable information (PII) or other sensitive or confidential material (PII is any information that can be used to confirm or corroborate a person’s identity)
  • any data that is not fully consistent with University’s policies on Data Protection, Data Processing, GDPR/DPA2018, Academic Integrity, Attribution and Ethics
  • any data related to University Intellectual Property
  • any data that is protected by Copyright, unless explicit permission for its use with AI tools has been obtained
  • any data, whose responses might result in reputational damage to The University of Leeds
  • any non-PII data from third parties where the individual has not explicitly consented for their data to be used with AI, with the exception of data that is clearly already in the public domain
  • any non-PII data from third parties where the explicit use of the data with AI has not been authorised by a University Faculty Research Ethics Committee application, irrespective of whether the data is in the public domain.

There is also guidance from IT Services on Security Considerations on the Use of ChatGPT and AI LLM Engines

You  must also ensure that any content shared with Gen AI tools is consistent with guidelines for the handling of material in any contractual agreements with individual sponsors or funders.

If there is any doubt, please email AI@leeds.ac.uk

Prompts

A prompt counts as input data. Consequently, a prompt must never contain any of the data types listed above.

Prompt text is the instruction (or instructions) provided by the user to the AI tool asking it to do something. For example: “Write a page of text about snowboarding in the style of Goethe.” Or: “Does the function fc(z^2+c) diverge to infinity if z is complex and the initial value of z=0?”

Security of prompts and input data

Your prompts and input data will only be secure if IT Services explicitly state the particular tool you use is secure.

Usually, data you input into AI tools are not secure. Data, prompts and output will be recorded by the AI provider and considered to be their own intellectual property. The material may be used to improve the AI tool, may be passed to national crime and security services, and may be sold to third parties mining data.