21 October 2026·9 min read·By ZAWAT Team

Your Staff Are Already Using AI Tools With Company Data: A Policy That Actually Works

Your staff are probably already using AI tools at work. They paste in a client email to draft a reply, summarise a contract, or clean up a spreadsheet of customer names. Banning that rarely works on its own: the tools are on everyone’s phone, and the time saved is real.

What works is a short policy with three parts:

an approved business tool whose terms exclude training on your data and let you control retention;
clear rules on what may never be entered — customers’ and employees’ personal data, client confidential material, trade secrets, credentials and unreleased financial information;
human review of anything AI-produced that leaves the company.

In Oman the policy is also a legal control. Pasting personal data into an AI tool hosted abroad is processing and a cross-border transfer under the Personal Data Protection Law. And trade secrets keep their legal protection only while you take reasonable steps to keep them secret.

The short answer

Give people a sanctioned tool, on business terms, so they have no reason to use personal accounts.
Publish a one-page list of what must never be entered, and what is fine.
Anonymise before pasting — strip names, numbers and identifiers.
Review every AI output before it reaches a client, a regulator or the public.
No automated decisions about people without human review.
Make reporting a mistake easy and fast, because the data protection clock may already be running.

What happened at Samsung

In 2023, according to an internal memo reported by Bloomberg, Samsung engineers had uploaded internal source code to ChatGPT. Samsung restricted staff use of generative AI tools on company devices. The memo’s stated concern was that data sent to external AI services is stored on outside servers, where it is hard to retrieve and delete and could be disclosed to others. The restriction was described as temporary while the company built internal tools and safeguards.

The lesson is not that AI tools are dangerous. It is that data typed into an external service leaves your control, and that a large, security-conscious company found this out after the fact. A mid-sized business in Muscat has fewer people watching and the same exposure.

Why bans don’t work on their own

A ban without an alternative moves the activity out of sight. Staff use personal accounts on personal phones, under consumer terms you have never read, with no company control over retention. The work still gets done; you simply lose visibility of where your data went.

Prohibition still has a place — for categories of data, not for the technology. The workable shape is: approved tools for approved purposes, and a short list of data that never goes into any external tool at all.

What the law says about pasting data into AI tools in Oman

Personal data. Entering a customer’s or employee’s details into an AI tool is processing of personal data. If the tool is hosted outside Oman, it is also a transfer abroad. The Executive Regulation requires the data subject’s explicit consent before such a transfer, unless the data has been anonymised or an international agreement applies. It also requires an assessment of the recipient’s protection. A breach of the transfer rule carries the Law’s heaviest fine, OMR 100,000 to 500,000.

The Law also obliges the controller to guarantee the confidentiality of personal data and not to publish it without prior consent. That duty sits in Article 21 and carries a fine of OMR 15,000 to 20,000.

The individual employee may not be thinking about any of this. The obligation, however, is the company’s.

Trade secrets. Oman’s Industrial Property Law protects undisclosed information against disclosure or use contrary to honest commercial practice. Part of the test is whether its holder took reasonable steps to keep it secret. A pricing model, a tender strategy or a customer list pasted into a public AI tool undermines that argument. A written policy, an approved tool and training are among the steps you can point to.

Client contracts. Many non-disclosure agreements and service contracts restrict disclosure of a client’s information to third parties. An AI provider is a third party. A consultant summarising a client’s confidential report in a consumer AI app may breach the client contract before any law is engaged.

Insiders. Separately, the 2026 Cybercrime Law penalises exceeding authorised access to information systems. It applies heavier penalties when that is done in the course of work. That is a reason to keep access rights tight in your own systems, so that what staff can reach — and could paste — is limited to what their job needs. Who can see what: access control and audit trails covers the design.

The policy, on one page

A policy people will read fits on a page. A workable version:

1. Use approved tools only. The company provides an approved AI tool on a business account — name it in your policy. Do not use personal AI accounts for work content.

2. Never enter:

customers’ or employees’ personal data — names with contact details, civil numbers, health information, salaries, addresses;
clients’ confidential documents or information covered by an NDA;
our trade secrets — pricing models, tender strategies, unreleased product plans, source code unless approved;
passwords, API keys, access tokens;
unreleased financial results or deal information.

3. Fine to enter: public information; your own drafts and notes without the items above; anonymised data with names and numbers removed; general questions.

4. Anonymise before you paste. Replace names with roles (“Customer A”), remove numbers, and delete anything that identifies a person or a client.

5. Check everything before it leaves. You are responsible for any AI-assisted output you send: facts, figures, legal statements and tone. AI tools make confident mistakes.

6. Be open about AI use where it matters — for example, when a client has asked to know, or the output is presented as expert advice.

7. No automated decisions about people. Do not use AI to decide on hiring, discipline, credit or refunds without a person reviewing the decision. Since September 2026, Oman’s law gives people the right to object to automated decisions and requires human review.

8. Report mistakes immediately to the person your policy names. If personal data went where it should not, the company may have 72 hours from becoming aware to notify the regulator.

Choosing the approved tool

The approved tool is what makes the policy credible. Check:

Training: the contract states your content is not used to train models. Business terms commonly say this; Anthropic’s Commercial Terms, for example, state that it “may not train models on Customer Content from Services”. Consumer apps are governed by different terms.
Retention: how long inputs and outputs are kept, and whether you can shorten it.
Location: where processing happens, for the transfer assessment Oman’s Regulation requires.
Administration: company sign-in, the ability to remove leavers, usage logs, and controls over sharing.
Data processing terms you can file in your processor register.
Arabic quality for the work your staff actually do.

If your use is document-heavy and confidential, an internal assistant that answers from your own files with your own permission rules may be the better tool. An AI assistant for your own staff covers that design.

Making it stick

Train with examples from your own business. “Can I paste this?” is answered faster by ten real cases than by a paragraph of principles.
Have managers model it. If leaders use personal AI accounts for board papers, no policy survives.
Make questions easy. A named person, or a channel, for “is this okay to paste?”
Review usage in the business tool’s logs, for patterns rather than to police individuals.
Revisit the policy when tools, laws or your business change. In 2026, Oman changed both its cybercrime and data protection laws.

Technical controls that help

Policy does most of the work, but a few controls catch common mistakes:

Data loss prevention rules on email and web uploads that flag civil numbers, card numbers and confidential labels.
Single sign-on for the approved tool, so access ends when employment does.
Blocking unapproved AI sites on company devices — only alongside an approved alternative, or the work moves to phones.

Frequently asked questions

Should we ban ChatGPT and similar tools at work? A ban without an alternative tends to push use onto personal devices, out of sight. A better approach is an approved business tool, a clear list of data that must never be entered, and human review of outputs.

Is pasting customer data into an AI tool illegal in Oman? It is processing of personal data, and if the tool is hosted abroad, a cross-border transfer. That requires explicit consent or another listed basis, plus an assessment, under the Executive Regulation. The company, as controller, is responsible, and the transfer rule carries the Law’s heaviest fines.

Does using an AI tool put our trade secrets at risk legally? It can. Oman’s Industrial Property Law protects undisclosed information where its holder has taken reasonable steps to keep it secret. Allowing confidential material into external tools without controls weakens that position.

What should an AI use policy include? Approved tools, a list of data never to enter, guidance on anonymising, a rule that outputs are reviewed before use, a ban on automated decisions about people without human review, and a fast route for reporting mistakes.

Do business versions of AI tools use our data for training? Business terms commonly exclude training on customer content, while consumer versions may not. Check the specific contract before approving a tool, along with retention, data location and administrative controls.

What should an employee do after pasting something they shouldn’t have? Report it immediately to the named person. If personal data is involved, the company may need to assess it as a breach, with notification to the regulator within 72 hours of becoming aware where data subjects’ rights are threatened.

This article states the position under the Personal Data Protection Law as amended by Royal Decree 68/2026, its Executive Regulation, the Industrial Property Law and the Law on Combating Information Technology Crimes, as in force on 21 October 2026, the date of publication. It is not legal advice; confirm your position with a qualified adviser.

Sources: NBC News — Samsung bans use of ChatGPT and similar tools after misuse · CSO Online — Samsung bans staff AI use over data leak concerns · Royal Decree 6/2022 — Personal Data Protection Law (Arabic text) · Ministerial Decision 34/2024 — Executive Regulation (Arabic text) · Royal Decree 67/2008 — Industrial Property Law (Arabic text) · Anthropic — Commercial Terms of Service

Want your team using AI with your data protected? ZAWAT builds AI and automation, including internal assistants that answer from your documents under your own access rules. Book a call.

Share:X in ✆