What got pasted into a chat window

The problem it solves

On a Friday afternoon, with a deadline already past, someone on the team pasted a client's entire file into a tool the company never contracted, never assessed, and could not say where it stores what it receives. There was no bad intent. There was hurry, and a tool one click away.

The company finds out months later, or not at all. In the meantime it has signed a confidentiality agreement with that client that contemplates none of this, it has no way of saying what left or when, and no idea how often the same thing happened with other files. The inventory of tools the leadership believes is in use and the one the team actually uses are two different lists, and almost nobody has held them up against each other.

On the day something goes wrong, a client's data somewhere it should not be or a document with an error that reached a third party, the organisation discovers that the problem was never technical. Nobody had written down what was permitted, nobody reviewed before sending, and there is no plan for the first hour.

What it covers

The day opens with the inventory almost no company has: the one of actual use. In a group exercise, with no hunt for culprits and that said out loud in the first minute, the room establishes which tools the team is using, for which tasks, with what information, and since when. The resulting list rarely matches what the leadership expected, and that gap sets up the rest of the day.

The second block classifies the company's information. Not into theoretical categories but through three practical questions: what may leave without difficulty, what may leave under conditions, and what never leaves at all. The confidentiality commitments already signed with clients get read out too, because they are usually stricter than the team remembers and more specific than the leadership assumes.

With that in front of them, the group drafts the rules. They are written so that somebody can follow them on a rushed Friday: short, with an owner for each, with the mandatory review before anything reaches a client or an authority, and with consequences the organisation is genuinely willing to apply. A rule nobody will enforce is worse than no rule, because it manufactures a false sense of safety.

The final block is a scenario exercise around an incident. The case is put on the table and the group decides what happens in the first hour, who tells whom, what gets documented, what the client is told and in what order. The day closes by agreeing how often the policy is revisited, who maintains it, and how it gets explained to somebody joining the company next week.

What participants learn

• Inventory the tools the team is genuinely using, authorised or not.
• Classify company information by whether it may leave, may leave under conditions, or never leaves.
• Draft short rules of use with a named owner and consequences the company will actually apply.
• Define the mandatory review before anything reaches a client or an authority.
• Design the first-hour response to an error, a leak or a complaint.

Agenda

1. 01An inventory of actual use, not authorised use
2. 02Information classification and what may leave the company
3. 03Confidentiality commitments already signed with clients
4. 04Human review before publishing, sending or replying
5. 05A record of assisted decisions and who answers for each
6. 06What happens when an output turns out to be wrong
7. 07How the policy reaches the team, and how often it is revisited

What the organisation leaves with

• An inventory of actual tool use in the organisation, with the information each one receives.
• A classification of company information into what may leave, what may leave conditionally, and what never does.
• A one-page draft policy with an owner per rule and a mandatory review before anything is sent.
• A first-hour incident routine: who is told, what is documented, and what is communicated.