Keeping client passport and booking details out of AI tools

Leave anything that identifies a client out of a chat box by default. Passport numbers, birth dates and payment details never need to be there to get a good draft.

What counts as client information

Personal data is any information related to an identifiable person¹. That's broad. A name alone might not identify someone, but bits of information such as names may later be combined with other information to identify persons and expose them to harm¹.

For a travel office, the list looks like this.

• Passport details. Number, expiry date, photo page, scan. Many countries now issue biometric passports, which contain an embedded microchip².
• Dates of birth, home addresses, phone numbers and email addresses.
• Payment details. Card numbers, bank details, receipts.
• Booking references together with surnames. Together they may let someone look up a booking, depending on the supplier.
• Special requests that reveal personal circumstances. Medical needs, mobility needs, dietary needs linked to religion or health, and who's travelling with whom.
• Children's details.
• Login details for supplier portals and booking systems.

You almost never need any of these to draft a good message. Use placeholders such as [CLIENT], [REF] and [DOB] and put the real values in after.

What the tool might do with what you paste

Each tool has its own rules, and they change. As of 10 November 2026, OpenAI's help page says that available controls depend on whether you are signed in, your plan and your workspace settings³. On personal workspaces with ChatGPT Free, Plus or Pro, data sharing is enabled by default³. By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces to train its models³.

Turning the training setting off doesn't delete saved chats³. So a chat you've pasted a passport number into can stay in your history.

That's one maker's page, checked on one date. Other tools have their own pages and plans. Read the maker's current privacy and data pages for whichever tool your staff use, and note the date you read them.

Rules you may need to look up

Privacy law differs by country, and this site can't tell you what applies to your agency. Go to the official body.

• Australia: start with the Office of the Australian Information Commissioner (OAIC) and its pages on the Australian Privacy Principles. These replaced the earlier principles on 12 March 2014⁴. Ask whether it has current guidance on AI tools.
• United Kingdom: start with the Information Commissioner's Office (ICO), and look for its data protection and AI pages.
• United States: start with the Federal Trade Commission (FTC) and its business guidance on privacy and data security. State rules differ, so check yours.
• Elsewhere: look for your country's privacy regulator.

Those bodies' own pages are the place to find out whether a rule covers your business. Nothing here says a practice meets any law.

Habits that help

1. Write a one-page rule for staff. Say which tools are allowed and what never goes in.
2. Use business accounts with the maker's privacy terms read, not free personal accounts, for work involving clients. Read those terms first, as plan terms vary.
3. Strip details before you paste. Replace names with [CLIENT] and keep dates only if the task needs them.
4. Don't upload passport scans or booking PDFs to a chat tool.
5. Add the real details after. Fill in names and numbers in your email program, not in the AI tool.
6. Delete test chats when you finish, knowing that deleting a chat is a separate step from any training setting.

If something was pasted by mistake

Tell whoever manages privacy in your business straight away. Look at the tool's help page for deleting chats and its data controls. Then check what your national privacy body expects about telling people. The answer depends on your country and the facts.

Passport validity is a client matter too, but it isn't something to check with a chat tool. There is an increasing trend for adult passports to be valid for ten years², yet rules differ by country. Send clients to the issuing government's own pages.