Telkom warns of data leakage risks from public AI use
Telkom Indonesia warned that employees using public AI platforms like ChatGPT and Gemini to process internal company documents face data leakage risks, as documents uploaded to these services are stored on the platforms' servers and may be accessible to other users. The company recommended that businesses implement strict policies preventing employees from uploading sensitive data to public AI tools and instead use internal AI systems.
What happened
Telkom Indonesia's Executive General Manager Digital Product Komang Budi Aryasa warned that employees using public AI platforms like ChatGPT and Gemini to process internal company documents risk data leakage. When documents are uploaded to these public platforms, they are stored on the platforms' servers and may be retrieved by other users, including competitors or bad actors, when similar prompts are made.
Reported impact
Telkom noted that some companies have banned use of public AI services and others have invested in building internal AI systems to mitigate data leakage risks. Komang stated that companies require strict policies and enforcement to prevent employees from uploading sensitive internal documents to public AI applications.
Index analysis
The incident reflects risks inherent to public AI platforms' data storage practices, where documents uploaded by users can potentially be accessed or revealed to other users. Telkom identified a gap between the ease and accessibility of public AI tools and the security controls needed to protect sensitive business data.
Governance controls
Telkom recommended that companies establish clear policies restricting employees from querying internal documents on public AI platforms. The company suggested directing employees to use internal AI systems built specifically for the organization rather than public services.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.