How do I stop employees pasting sensitive data into ChatGPT?

Domain blocking looks decisive and produces the worst measurable outcome: employees who need the tool will use it on hardware you do not manage, where you have no telemetry at all. You have converted a visible, governable risk into an invisible one.

Miss any one of them and the control either does not prevent anything, or gets bypassed.

Start in log-only for two to four weeks on one department. You are not protecting anything yet; you are measuring how noisy detection is against real traffic.

Then warn, and watch the click-through rate. High dismissal is a precision problem, not a discipline problem, and escalating to blocking will produce circumvention rather than compliance.

Then block, starting with checksum-validated detectors only (card numbers with a valid Luhn check, recognised key prefixes) where a false positive is nearly impossible.

The technical rollout is the straightforward part. What determines whether this works is a conversation with staff that most organisations have too late, after somebody notices a warning nobody warned them about.

Three things are worth saying explicitly, in writing, before anything is enabled. What is inspected and at what moment, which for an on-device control is the text in the composer at the point of sending and nothing else. What is recorded, which should be a category and a masked snippet rather than the message. And what is not recorded at all, which is the sentence people actually want and the one usually left out.

The framing matters as much as the content. Most pasting is somebody trying to finish a task with the best tool they could find, so a rollout presented as catching misconduct earns resistance it did not need. A rollout presented as making a good tool safe to use tends to go through quietly, and in several jurisdictions the notice is a legal requirement rather than a courtesy.

Blocking is the control everyone reaches for first and the one most often set too wide. A block that fires on things people legitimately need to do teaches them to find a path without it, and the path they find has no telemetry at all.

The categories worth blocking outright are the ones where a false positive is nearly impossible and the consequence is severe: a primary account number with a valid checksum and a recognised issuer prefix, a private key block, a credential pair, a patient identifier alongside clinical context. Everything else is better served by a warning that names what was found and lets the person decide, because the person usually has context the rule does not.

Warnings have their own failure mode. A warning that fires too often stops being read within about a fortnight, and after that it is worse than nothing because it manufactures a record of people clicking through. Precision is the number to watch during a pilot, not recall.

Most dashboards in this category report alert volume, which goes up when the tool gets better and down when it breaks, and therefore says very little on its own.

The measure that reflects whether anything changed is repeat events per person over time. A population where the same twenty people trigger the same warning every week has not absorbed anything; the warning has become background. A population where most people trigger once and then stop has learned where the line is, which is the actual goal. Alongside it, the count of distinct unrecognised destinations is worth watching, because a rising number there means new tools are arriving faster than your sanctioned list is being maintained.

A caution about the first fortnight. The initial numbers are always worse than expected and are not a measure of your staff. They are a measure of how long the gap has been open, and reading them as misconduct is the fastest way to lose the goodwill a rollout needs.