Safety, Privacy, and Responsible Use of Copilot
Lesson 1: What Not to Share – Six Categories of Information to Keep Out of Copilot
Lesson Objectives
By the end of this lesson, students should be able to:
- Name and explain the six sensitive information categories
- Apply the anonymization technique to work with sensitive topics
- Distinguish between appropriate professional context and inappropriate sensitive disclosure
- Apply these principles specifically to Microsoft 365 Copilot integration scenarios
Lesson Content
The default posture: semi-public.
When you type something into Copilot – whether at copilot.microsoft.com, through Windows, or within Microsoft 365 apps – treat it as you would writing on a whiteboard in a shared conference room. Visible, retained in some form, and potentially reviewed. Not a reason to avoid Copilot; a reason to be intentional about what you share.
The six categories to keep out of Copilot.
Category 1 – Personal identification information. Never paste: Social Security numbers, passport numbers, driver's license numbers, government ID numbers, or combinations of information that uniquely identify a specific individual.
Category 2 – Financial account details. Never paste: Bank account numbers, credit card numbers, investment account details, routing numbers, or passwords and PINs for any financial system.
Category 3 – Passwords, credentials, and access tokens. Never paste: Any password, login credential, API key, security token, or system access code. No legitimate use case requires pasting a password into an AI assistant.
Category 4 – Protected health information. Never paste: Medical records, prescription details, therapy notes, insurance claim details, or health information that identifies a specific individual.
Category 5 – Confidential business and organizational information. Apply judgment here. Be careful about pasting: proprietary product designs or trade secrets, unreleased financial results, strategic plans that are not public, confidential personnel matters, legally privileged communications, or client data not yours to share. Before pasting any work document, ask: would I be comfortable if my organization's legal team could see this in an AI system?
Category 6 – Other people's private information without their knowledge. Pasting someone else's personal information – their email, their salary, their performance review, their health details – without their knowledge raises ethical and potentially legal concerns.
Special consideration for Microsoft 365 Copilot integration.
When Copilot is integrated directly into your email, documents, and calendar through Microsoft 365, you may find yourself working with sensitive content more naturally than in a standalone interface. The same six categories apply – but the integration makes it easier to accidentally include sensitive content. Before using Copilot to summarize an email thread or analyze a document, verify the content does not fall into any of the six categories.
The anonymization technique.
Replace specific identifying details with generic placeholders:
Instead of: "My client, [Name] at [Company], signed a contract for $450,000 on [date]…" Use: "A client in the [industry] sector signed a contract for approximately $X in [quarter]…"
The analytical task almost never requires the identifying details to be completed effectively. Anonymize first, then engage Copilot.
Enroll to continue this lesson.
The preview above shows the lesson objectives and opening lesson content. Enroll to view the full lesson, complete the practice work, and take the lesson quiz.