Staff notice template

Send this (adapted) to everyone whose browsers or Macs will run Prism, before you roll it out. Being open about what’s checked is the right thing to do and expected under UK and EU data protection law. Replace the bracketed parts; delete the Mac paragraph if you’re only rolling out the browser extension, and the “all sites” sentence unless you use that version.

Subject: Protecting company data in AI tools: Prism DLP

Hi all,

We use AI tools like ChatGPT, Claude and Copilot more every day, and it’s easy to paste something into one that shouldn’t leave the company: an API key, customer details, a card number, a confidential document. From [date] we’re rolling out Prism DLP on company browsers [and Macs] to help catch that before it happens.

What it does

When you paste, upload or send a message in an AI tool, Prism checks it against our data policy before the AI tool receives it. Most of the time you won’t notice anything.
If it finds something sensitive, it tells you exactly what and why, and depending on the setting asks you to confirm with a reason, offers to send it without the sensitive parts, or stops it.
[For the first [week], it only records what it finds and doesn’t block anything, so we can make sure it’s accurate.]
It shows us which AI tools are used and for how long each day, so we can make sure people have the right ones (and approve good ones).
[On Macs, it also checks pastes into AI desktop apps and records files copied to USB drives and cloud-sync folders.]
[On company browsers it checks pastes and uploads on all websites, except [list], not just AI tools.]

What it doesn’t do

It doesn’t record your keystrokes, your screen, or your browsing beyond which AI tools are used and for how long; messages are checked only when you send them, never while you type.
Sensitive values it finds (keys, card numbers, personal details) are replaced with placeholders before anything is stored; the originals are never kept.
It does nothing outside the AI tools we’ve chosen [and USB/cloud copies on Macs].

If it gets in your way If Prism stops something you genuinely need to do, tell [security contact] and we can allow it for you for a limited time. Please don’t work around it. The “Learn more” link in Prism’s messages explains what happened and your options: https://prism-dlp.com/staff.

The full privacy policy is at https://prism-dlp.com/privacy. Questions to [contact].

Thanks, [Name]

Updated 9 October 2026