Practice a leak: a 30 minute team exercise

A practice exercise for a team, run by one person, in 30 to 45 minutes. Nothing here is scored and nothing is recorded by this site. Read each stage aloud, give the team a few minutes on the questions, then open the model answer and compare. Keep notes as you go and fill in the record at the end.

This is a practice scenario, not a report of a real incident, and it is general information, not legal advice.

9.10am

Stage 1: someone tells you

A staff member comes to you and says that yesterday they pasted a spreadsheet into a free AI chatbot to tidy it up. It held the names, phone numbers and email addresses of about 200 customers. They used their own personal account, not a work one.

Discuss

  1. What do you do in the next 30 minutes?
  2. What do you ask the staff member, and how do you ask it?
  3. Who else needs to know today?
Open the model answer
  • Thank them for telling you. The next person will only come forward if this one is not punished for it.
  • Find out exactly what was pasted, into which tool, from which account, and when.
  • Record it before anyone deletes anything: the time, the tool, the account, what the file held, and who knows. Deleting first destroys the record of what went in.
  • Stop any further use of that tool for work until you know more, and tell the person who looks after privacy in your business.

This is Basic 6 and Intermediate 7 in practice.

10.30am

Stage 2: it is worse than it looked

Checking the file, you find a column nobody mentioned: notes. For a handful of customers it records a health condition or a payment difficulty. The chatbot account had its chat history switched on, and its settings allowed the provider to use conversations to improve its models.

Discuss

  1. Does this change how serious it is? Why?
  2. What can you still do about the copy in the tool, and what can you not undo?
  3. Is it time to start deciding whether this must be reported?
Open the model answer
  • Yes. Health details and money trouble are exactly the kinds of information that make harm to a person more likely.
  • Now that it is recorded, use the tool's own delete and privacy controls, and ask the provider in writing about deletion. A confirmation covers the copy in the tool, not what was already stored or seen.
  • Start the serious harm assessment now, and keep writing down what you find and why you are deciding what you decide.

Intermediate 4 covers where data goes; Intermediate 7 covers the assessment.

1.15pm

Stage 3: the phone rings

A customer on the list calls. A friend told them about AI leaks, and they want to know whether you have ever put their details into an AI tool.

Discuss

  1. What do you say, and what do you not say?
  2. Who takes this call?
  3. What do you promise, and by when?
Open the model answer
  • Do not guess and do not deny. Take their details, say you are looking into how their information was handled, and give a time you will come back by.
  • Route the call to the person running the response, and add it to the record.
  • Remember they are entitled to ask what personal information you hold about them, and chat histories held for the business can count.

Advanced 5 covers the access right.

4.00pm

Stage 4: decide

You now know what went in, what was sensitive, what the tool did with it, and that at least one person is asking. Decide.

Discuss

  1. Does this meet the notifiable breach threshold? Write down why, either way.
  2. If it does, who is told, by whom, and when?
  3. What changes so it does not happen again, and who owns that?
Open the model answer
  • The Office of the Privacy Commissioner states the duty this way: "if your organisation or business has a privacy breach that either has caused (or is likely to cause) anyone serious harm, you must notify the Privacy Commissioner and any affected people as soon as you are practically able."
  • If you decide the threshold is not met, the written reasons are what you will be asked for later, so keep them.
  • Either way, fix the cause last, not first: an approved tool for this kind of job, a never paste rule people know, and a way to report a slip without fear.

Read the Privacy Commissioner's guidance on privacy breaches at privacy.org.nz.

Debrief

  1. What would have made the first 30 minutes easier?
  2. Do we have an approved tool for the job this person was trying to do?
  3. Would our staff tell us, or would they stay quiet?

The record

Print this page or copy the table. In a real incident this is the record you would keep.

Date and who took part
What happened, in two lines
What personal information was involved
Who knew, and when
What we did to contain it
Our serious harm assessment, and why
Decision on notifying, and who made it
What we are changing, who owns it, by when
Date we will run this again