IP, Confidentiality & Data

Start with the duty that predates AI entirely: you owe your clients confidentiality. Their drawings, briefs, site information, costs, contracts and the personal data of the people involved are theirs, held by you under an obligation - usually contractual, always ethical - to protect them and use them only for the work. Agents do not weaken that duty; they create a new and easy way to breach it. The breach is not dramatic. It is a designer, under deadline, pasting a confidential brief or uploading a set of client drawings into whatever agent is to hand, without a thought about where that material now goes. The moment it crosses from your side to the agent's side, you have disclosed it - and you need to have decided, before that moment, whether you were entitled to.

The practical discipline is to treat the boundary between your systems and any external agent as a real line, and to know what you are sending across it. Before confidential material crosses, ask a short set of questions. Where is it processed and stored, and in what country? Is it used to train the vendor's models - that is, could your client's data end up shaping a system others use? Who at the vendor can see it, and for how long is it retained? What do the terms of service actually say about your data and your rights? And has the client consented to their information being handled this way? You cannot answer these by intuition; you answer them by reading the vendor's data terms and choosing tools whose handling you understand and can defend. The stakes differ by material: a generic massing study is low-risk; a named client's unbuilt design, personal data, or commercially sensitive strategy is high-risk and may not belong in a consumer tool at all.

The defensive posture is simple and it protects you: assume anything you send to an external agent may be seen or retained, and send accordingly. Prefer tools with clear terms that do not train on your data and that process it appropriately; strip or anonymise personal and identifying detail when the agent does not need it; keep the most sensitive material out of external agents entirely, or use options designed for confidentiality; and never paste something you would not be able to defend having disclosed. Confidentiality is not a reason to avoid agents - it is a reason to use them knowingly, choosing what crosses the boundary on purpose rather than by reflex under pressure.

Confidentiality is about your duty to the client; data privacy adds a further, legally enforced duty about the personal information of individuals. Design work is full of personal data - the names, contacts, family details, financial information and sometimes sensitive circumstances of the people a project is for - and feeding that data into an agent is a data-processing act with legal consequences, not just an ethical one.

In India this now has statutory teeth. The Digital Personal Data Protection Act establishes obligations around how personal data is collected, used, shared and protected, and around the consent of the person whose data it is. The details and the enforcement are evolving, and this course does not give legal advice - but the direction is unmistakable and it applies directly to a practice that pipes client and occupant data into AI systems. You should assume that personal data you handle carries obligations: to have a lawful basis and, generally, consent for using it; to use it only for the purpose it was given; to protect it; and to be answerable for where it goes, including to any external agent or vendor you route it through. The same logic holds globally under regimes like the GDPR for anyone serving clients in those jurisdictions. The safe professional stance is to treat personal data as regulated material that requires care and consent whenever it leaves your control.

Practically, this means a few concrete habits. Minimise: do not feed an agent personal data it does not need - anonymise, aggregate or strip identifying detail wherever the task allows. Know your vendor's terms: whether it processes data appropriately, whether it trains on it, where it is stored, and what contractual protections exist. Get consent where it is required, and be able to show you did. And keep the most sensitive personal data out of casual consumer tools, using only options whose data handling you can stand behind. None of this is a reason to fear agents; it is the ordinary professionalism of handling other people's information carefully, extended to a new and powerful conduit. The designer who is careless with client data in an agent is exposed twice over - to a breach of confidentiality and to a breach of law - and both land on the accountable human, not the tool. Handle data as deliberately as you handle a life-safety detail: with care, with consent, and with a clear head about where it goes.

The second strand is genuinely unsettled, and honesty about that is part of teaching it well: who authors, and who owns, a design produced with heavy AI assistance? The law is moving, varies by country, and has not resolved the hard cases - so the goal here is to understand the shape of the question and act prudently, deferring the actual ruling to a qualified lawyer.

Start with what is reasonably clear. In many jurisdictions, copyright protection has historically required human authorship - a purely machine-generated output, with no meaningful human creative contribution, may attract little or no copyright protection, which means you might not own it in the way you own your own drawing, and neither might anyone else. The more your own judgement, selection, arrangement and creative decision-making shape the result - the more the AI is a tool you directed rather than an author that produced - the stronger the case that the work is yours and protectable. This is another reason the through-line of the course matters commercially as well as ethically: human authorship is not just where responsibility lives, it is where ownership is strongest. Design that is truly your creative work, made with an agent as an instrument, stands on firmer ground than output you merely accepted.

Three further questions sit alongside ownership of the output. Rights in the inputs: did you have the right to feed the agent whatever you gave it - a client's material, a reference image, a competitor's drawing? Feeding in protected work you do not have rights to is a risk regardless of what comes out. The training-data question: some models were trained on large bodies of others' protected work, and this is the subject of live legal dispute; an output could, in rare cases, reproduce protected expression from that training. The vendor's terms: the tool's own agreement may assign, license or claim rights in what you make with it - you need to read what you are agreeing to. The prudent posture is: maximise your own creative authorship so the work is genuinely yours; be careful about the rights in what you feed in; avoid outputs that echo an identifiable existing protected design; read the vendor's IP terms; and, for anything that matters commercially, get proper legal advice rather than relying on this or any general explanation. The law will keep changing; the discipline of authoring genuinely, respecting others' rights, and knowing your terms will keep serving you through the change.

The third strand turns the first two into practice: how you keep clients informed, get the consent you need, and set up your agreements so agentic work is trustworthy and defensible. This is where confidentiality, data and IP meet the relationship at the centre of professional life.

Start with honesty about AI use. Clients are increasingly aware that AI is part of design work, and being straightforward about how you use agents - what they help with, and, crucially, how you protect the client's information and remain responsible for the result - builds rather than erodes trust. Concealment does the opposite: a client who discovers, after the fact, that their confidential material was fed into tools they were never told about has a genuine grievance, even if nothing went wrong. The professional stance is disclosure appropriate to the sensitivity of the work - not a legalistic disclaimer, but a clear account that you use AI as a tool under your direction, that you protect their data, and that you remain the accountable professional. For many projects a short, plain statement is enough; for sensitive ones, an explicit conversation and consent is warranted.

Then the contracts. Your engagement terms should do real work here: address who owns the design and deliverables (so you can hand over clean title and there is no ambiguity created by AI involvement); establish consent for the data handling your workflow requires, including routing appropriate material through AI tools; and align with your confidentiality and data-protection obligations. Where a client imposes their own restrictions - a bank, a government body, a security-sensitive project may forbid external AI tools or particular data leaving their systems - your contract and your workflow must honour them, and you must actually know what your agents do with data in order to comply. This is not box-ticking; it is what lets you use agents without exposing yourself or your client.

The unifying principle is the one that runs through the whole module: you remain accountable, so decide deliberately. Choose what crosses the boundary on purpose; handle personal data as regulated material; author genuinely and know your rights; be honest with clients and get the consent your work needs; set contracts that let you deliver cleanly. And on any question with real legal or financial weight, explain the position to your client as this lesson has - clearly and honestly - and defer the actual determination to a qualified lawyer, because the law here is unsettled, jurisdiction-specific and moving fast. Handled this way, the data and rights questions become manageable professional practice rather than a hidden liability, and agentic work stays exactly what it should be: powerful, and trustworthy.