Your team uses AI. Your data stays yours.

1. The confidential list

Confidential commercial data is what makes your company competitive: distributor prices, margins, discount structures, wholesale terms, contracts, sales forecasts, allocations, negotiation strategy, unreleased vintages, launch plans, supplier terms, customer lists and customer purchasing history.

For a wine importer these are the numbers behind every deal: what you pay the winery, what the distributor pays you, what you would accept in a negotiation. That is not internal chit-chat; that is the business itself.

A simple test: if a competitor saw this document, would it change their behaviour? If the answer is yes — even a small yes — the document is confidential. Most documents fail this test quickly.

2. Why confidentiality is a legal obligation, not a preference

Under Germany's GeschGehG and the EU Trade Secrets Directive, a business secret is protected only if the company has taken reasonable steps to keep it secret. The steps do not have to be perfect — they have to be real, documented and communicated to staff.

One documented, acknowledged training module like this one is part of those reasonable steps. It shows that the company told its people what confidential means and where it may be processed.

If confidential data leaks through a private AI account, the consequences are practical before they are legal: a distributor learns another distributor pays less, a supplier learns what you would have accepted, a customer learns your margin. Relationships built over years can unwind in one afternoon.

3. The only allowed environment

Confidential data may only be processed in approved company AI — the tools with a company contract, listed in the AI policy, where the admin can see activity and the vendor cannot use the data freely.

It must also be processed 'for a reason': a task that genuinely requires the data. Summarising your own list, drafting a negotiation email, translating an internal contract for review — reasons that exist. Helping a personal hobby project, testing a new tool, 'just seeing what happens' — reasons that do not exist.

Never upload whole confidential documents to ask for general advice. Paste only the fragment that the task needs, and prefer company tools where the data stays under the company's control.

4. Real scenarios from the wine trade

Scenario A: the sales team drafts a distributor offer in the company ChatGPT workspace, using the real price list. Allowed — approved tool, genuine task, data stays inside the company contract.

Scenario B: the same offer typed into a free AI rewriter on a personal account because it 'writes nicer'. Not allowed — the price list enters a consumer service with no contract, and the admin cannot see it.

Scenario C: someone asks the company AI to 'turn this allocation plan into a bar chart' — the allocation plan is confidential, but generating a chart for an internal presentation is a legitimate task in the approved workspace.

Scenario D: a winery partner asks you to run their vintage forecast through your AI tool 'just to check'. Without a written agreement, that is someone else's confidential data entering your tools — ask the AI admin first.

5. Your three confidential reflexes

Reflex one — level first: before pasting, name the level out loud. 'This is the distributor price list — confidential.' If you cannot name the level, find out before you paste.

Reflex two — reason check: is the task real work, or convenience? Confidential data needs a reason to be processed, not just permission to exist in a tool.

Reflex three — ask: when a confidential document is going somewhere unusual (a new tool, a partner's system, an email to an outsider), ask the AI admin or your manager first. Ten seconds of asking beats an irreversible leak.