What is data leakage?
Data leakage is when information leaves the organisation or reaches people who should not have it, by mistake or through a deliberate act.
It can happen through a misdirected email, a file shared with the wrong link or a system that shows too much. When someone deliberately takes information out, it is often called exfiltration.
AI opens new routes. Text pasted into a public AI service leaves the organisation, and an AI agent tricked through prompt injection can pass data on to an outside recipient.
If the leak involves personal data, it is a personal data breach under the GDPR. As a rule it must be reported to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the people concerned.
How it works
A leak through AI need not be noticed. Someone pastes a contract into a public service, gets a good answer and moves on. An agent that has been tricked can send data out in a link or an image loaded from an outside server, without the user seeing anything.
Leaks can also happen inside the organisation. An AI assistant that ignores permissions can repeat information to people who have no right to see it.
Why it matters
What has leaked can rarely be recovered. The consequences can include lost business, damaged trust and liability under data protection rules. That is why the emphasis lies on prevention, with clear rules, approved tools and technical limits.
What to keep in mind
Start with shadow AI. Ask which services are in use and give people an approved alternative that is just as easy.
For AI agents the risk lies in the combination of access to sensitive data, content from unknown sources and the ability to send something outside the organisation. Break that chain, and read more about prompt injection.
What it means for you
Find out where your data could leave the organisation through AI, in the tools you have approved and in those that are used anyway.
Common questions
Is pasting data into a public AI service a data leak?
It can be. The data ends up with a supplier the organisation may have no agreement with, and if it involves personal data it may be a personal data breach.
What do we do if something has leaked?
Follow your incident procedure. If personal data is involved, it must as a rule be reported to the supervisory authority within 72 hours. Read more about GDPR and AI.
Sources: Personal data breaches at IMYRegulation (EU) 2016/679 on EUR-Lex
Related terms
Read more
All terms Updated