How to Use DeepSeek Safely at Work: A Checklist for Businesses

The short version

Treat the DeepSeek app like any outside service that stores data abroad: fine for public information, not for confidential data unless you’ve checked. For sensitive work, the open-weight models give you a way to use DeepSeek without sending data to it.

What DeepSeek’s own documents say

• Storage: “we directly collect, process and store your Personal Data in People’s Republic of China” (privacy policy, February 10, 2026).
• Use: inputs may be used to improve its models, with an opt-out.
• Disclosure: data may be shared with law enforcement or public authorities when DeepSeek believes the law requires it.
• Governing law: the terms are governed by the laws of mainland China.
• Sensitive data: the policy says the services aren’t designed for it and asks you not to provide it.

What governments have done

These actions apply to government systems or, in Italy’s case, to processing of Italian users’ data. They aren’t general bans on businesses:

• Australia: the Secretary of Home Affairs told a Senate committee that a direction issued on February 4, 2025 prohibits DeepSeek products, applications and web services on Australian Government systems.
• United States: on October 20, 2026, the Department of Homeland Security published an order excluding DeepSeek products from federal civilian agency purchasing and removing them, and third-party products developed using DeepSeek implementations, from those agencies’ IT.
• Italy: on January 30, 2025, the Garante ordered an urgent limitation on processing Italian users’ data by DeepSeek’s companies.

If you sell to government agencies, ask your contracting officer how such rules affect you.

Step by step

1. Classify your data. Public, internal, confidential, regulated (health, financial, personal).
2. Check your obligations: client contracts, NDAs, privacy laws, industry rules and government contracts.
3. Decide per data class: for example, app allowed for public data only; local models for internal data; nothing AI-assisted for regulated data without legal review.
4. Pick the setup. App, API, or a model on your own hardware. See run DeepSeek locally.
5. Write a one-page rule and tell staff. Include what never to paste.
6. Turn off “Improve the model for everyone” on any accounts used for work.
7. Review it every six months. Policies and laws change.

Prompts to copy

Draft your AI use rule:

Draft a one-page AI tool policy for a [size, industry] business.
Data classes: public, internal, confidential, regulated.
Rules: [your decisions]. Plain English, with examples of what staff may and may not paste.

Example

A 12-person accounting firm decides: staff may use the DeepSeek app to explain tax concepts and draft generic newsletters. Client names, figures and documents are never pasted. One office PC runs a distilled DeepSeek-R1 model locally for internal drafts.

Mistakes to avoid

• No rule at all. Staff will decide for themselves.
• Confusing the app with the open weights. Weights you run on your own hardware keep data in-house; the app is a service with its own policy.
• Ignoring output accuracy. DeepSeek’s terms require human review when outputs affect important decisions about people.

When not to use it

Skip the app for customer records, health or financial data, trade secrets and anything under NDA. If you’d like help setting up AI tools safely, see what we do for you.

Related: keep your data private in DeepSeek and the DeepSeek open-weight license.