Cybersecurity, Data Privacy & Responsible AI

Identify risks involving data, inaccurate outputs, cyber threats and inappropriate decisions. Match each risk to a realistic workplace activity and responsible owner.

Locate the organisation's tool list and acceptable-use rules. Practise checking approval, account configuration and permitted tasks before using a system.

Distinguish public, internal, confidential and sensitive information using company definitions. Decide what can be used, transformed or kept out of an AI workflow.

Identify unnecessary personal details in sample inputs. Practise using the least information needed and routing unclear cases to the relevant company specialist.

Identify questions about storage, account access, reuse and deletion. Learn to request authoritative configuration information rather than assuming every tool handles data alike.

Recognise customer secrets, proprietary material and rights questions. Check permissions and approved sources before uploading or distributing content.

Examine suspicious messages and simulated audio or video requests. Verify identity through established channels, especially before transferring funds or sharing information.

Spot embedded instructions that ask an assistant to reveal information or take actions. Apply approval boundaries and report suspicious content through the company's process.

Identify outputs whose errors could materially affect people or operations. Require appropriate evidence, specialist review and documented approval.

Inspect fictional outputs for stereotypes, exclusions and unjustified comparisons. Ask whose perspective is missing and how the result should be reviewed.

Decide when AI assistance should be disclosed under company rules. Assign a human owner and keep enough evidence to explain the process and result.

Define when to stop, ask a supervisor or consult security, privacy or another specialist. Practise resisting pressure to bypass controls for speed.

Work through an accidental-upload or incorrect-output scenario. Follow the internal response route, record relevant facts and avoid further unauthorised disclosure.

Create a concise checklist for approved tools, permitted inputs, verification, approval and incident reporting. Have the responsible company owners review it.

Respond to a suspected deepfake, confidential upload, unsupported claim, biased recommendation and malicious document. Explain the decision, safe next step and escalation route for each.