The situation
It is Tuesday afternoon. An associate mentions, almost in passing, that they pasted a draft share purchase agreement and the client's disclosure schedule into ChatGPT last week to tighten the indemnity language. The schedule lists employees by name, with salaries. The associate used a personal account on a firm laptop. Nobody else knew.
The supervision question is covered in what a partner owes when a student pastes a client file into AI. This guide covers the urgent one: what the firm does in the next 48 hours.
Hours 0 to 4: contain and preserve
- Stop further submissions. Ask the associate not to continue the conversation or upload anything else to that account.
- Preserve the facts before anything is deleted. Capture the conversation showing the date, the account, and exactly what was pasted or uploaded.
- Identify the account type. A personal account is governed by the individual's own settings. OpenAI says that, by default, it does not use content from ChatGPT Business or Enterprise workspaces to train its models (OpenAI data controls).
- Check the training setting. On a personal account, note whether "Improve the model for everyone" was on. OpenAI describes turning it off as applying to new conversations, so switch it off now and record what it was at the time of the incident.
- Then delete, once preserved. OpenAI states that a deleted chat leaves the account view immediately and is scheduled for permanent deletion within 30 days, unless it was already de-identified or OpenAI must keep it longer for security or legal reasons (OpenAI help centre). Deletion limits further exposure. It does not reverse the disclosure.
Hours 4 to 24: assess
Record what was submitted (documents, personal information, privileged advice, commercial terms), which client and matter, whose information was included, and when. This inventory drives every decision that follows.
Hours 24 to 48: decide and notify
Decide, with the right advisors, on the privacy report, the client conversation, and the insurer notice described below. Document each decision and the reasons for it.
What the rules actually say
Federal privacy law (PIPEDA). PIPEDA defines a breach of security safeguards to include the unauthorized disclosure of personal information resulting from a failure of the organization's safeguards. Under section 10.1, an organization must report a breach to the Privacy Commissioner, and notify affected individuals, if it is reasonable to believe the breach creates a real risk of significant harm. The factors include the sensitivity of the information and the probability it will be misused. Section 10.3 requires a record of every breach, whether or not it is reported, and the regulations set that retention at 24 months. See our PIPEDA overview for context.
Quebec. For firms subject to Quebec's private sector act, sections 3.5 to 3.8 apply to a "confidentiality incident", which includes communication of personal information not authorized by law. The firm must take reasonable measures to reduce the risk of injury. If the incident presents a risk of serious injury, it must promptly notify the Commission d'accès à l'information and the affected persons. The risk assessment weighs sensitivity, consequences, and likelihood of misuse, with input from the person in charge of protecting personal information. Every incident goes in the firm's register.
Informing the client (Ontario). The Law Society of Ontario's rule 7.8-1 applies when a lawyer discovers an error or omission that is or may be damaging to the client and cannot readily be fixed. The lawyer must promptly inform the client, recommend independent legal advice, and advise that the lawyer may no longer be able to act. The duty of honesty and candour in rule 3.2-2 points the same way. Whether a given AI disclosure crosses the 7.8-1 threshold is a judgment call. Make it with a practice advisor, not alone. The Federation of Law Societies Model Code contains the same rule; Quebec lawyers should confirm the equivalent obligations with the Barreau du Québec.
The insurer. Ontario's rule 7.8-2 requires prompt notice to the insurer of any circumstance that may give rise to a claim, and its commentary notes the policy requires this contractually too. LAWPRO asks lawyers to report real or possible mistakes immediately and cautions against trying to repair a potential claim on their own. If the firm also carries a separate cyber policy, check its notice clause.
British Columbia. The Law Society of BC's generative AI guidance points to Law Society Rule 10-4, which requires a lawyer to notify the Executive Director in writing immediately on reason to believe they have lost custody or control of practice records.
Why policies and bans fall short
Most firms that face this scenario already had a policy. The associate knew the rule and made a judgment under deadline pressure, on an account the firm could not see. That is the pattern: the incident surfaces only because someone volunteers it, days later.
Without a record, the firm relies on memory to answer what the regulator, the client, and the insurer will ask: what exactly was sent, when, and has it happened before. A policy tells people what not to do. It does not tell the firm when it happened, and it does not stop the submission.
What a practical control looks like
- Write the playbook down now. Assign an incident owner, list the steps above, and keep contact details for your practice advisor, insurer, and privacy officer in one place.
- Make self-reporting safe. An associate who reports within the hour gives you options. One who hides it for a month does not.
- Offer a sanctioned tool with business terms, configured and documented, so the fast option is also the approved one.
- Train on the specific risk: client names and identifiers, personal information, and deal terms, and why a submitted prompt cannot be recalled.
- Keep a register of AI incidents alongside your privacy breach records.
- Prepare a client communication template so the conversation, if needed, is prompt and measured.
Sanitized Ai is a browser extension that works at the point where this incident starts. When someone is about to submit client names, personal information, or deal terms to an AI assistant, it redacts or blocks the sensitive content before submission and explains in plain language what was flagged and why. The incident in this guide can become a near miss, and a lesson learned in the moment.
Administrators get a dashboard of flagged-event metadata (which tool, what type of data, which policy, when) without ever seeing prompt content. That record can help show the firm took reasonable safeguards, which is useful when a client or insurer asks. See how it fits law firms.