ChatGPT for business: privacy, GDPR and safe use

You can use ChatGPT at work, but not with all data. With the free version from OpenAI, your input can be used by default to train the model, even if it contains customer details or confidential information. As soon as you enter personal data, GDPR (AVG) obligations apply that many companies have not sorted out yet.

What happens to what your staff paste into ChatGPT?

Staff often start using ChatGPT on their own, and few people know how the platform treats their input. With the free version, that input can be used by default to keep training the model.

That has real consequences. An employee who pastes a summary of a customer call into ChatGPT shares that customer's personal data with OpenAI. An HR employee who has a performance review rewritten sends sensitive staff data into the cloud.

So the question is not whether ChatGPT is useful, because it is. The question is which rules you set as an employer, so that use stays within the GDPR (AVG).

Free, Team or Enterprise: how does each plan treat your data?

Not every ChatGPT plan handles your data the same way.

Free and Plus

Your input can be used for model training by default. You can switch that off yourself under Settings → Data controls → Improve the model for everyone, but that only applies to new conversations. What you entered earlier has already been processed. And it depends on every single employee whether that setting is really off.

ChatGPT Team (about €23 per user per month)

Your data is not used for training. As admin you control the workspace, you can build shared GPTs for your team and you get higher usage limits. This is the minimum level if you work with customer data or personal data.

ChatGPT Enterprise

Extended security options: SSO, audit logs, AES-256 encryption and SOC 2 Type 2 and ISO 27001 certification. For companies with strict compliance requirements or in sensitive sectors like healthcare, finance or legal, this is the right level.

The rule of thumb: if you work with company data, use Team at minimum. If you have compliance obligations, choose Enterprise.

Which GDPR (AVG) obligations do you have with ChatGPT?

If your staff use ChatGPT with personal data, your company is responsible for the processing. That brings three obligations.

1. Data processing agreement

OpenAI then processes personal data on your behalf, so you need to sign a data processing agreement (verwerkersovereenkomst) with OpenAI. With business plans you can do that through OpenAI's business terms. Without a data processing agreement you break the GDPR, even if nothing goes wrong.

2. DPIA (Data Protection Impact Assessment)

With large-scale processing of personal data, or new technologies with a high risk, a DPIA can be mandatory. A DPIA maps the privacy risks of your AI use and shows that you control them. If you use AI tools for personal data on a regular basis, it is sensible to do one, even if you doubt whether it is required.

3. Processing register

Processing of personal data belongs in your processing register. ChatGPT use where customer data is entered counts there too. A short description of who, what, why and how long is enough.

Fines for GDPR breaches can run high: up to €20 million or 4% of worldwide annual turnover, depending on the breach. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises this and can also step in at companies that have no data processing agreement.

Which data is fine and which never goes into ChatGPT?

A practical split for your team:

Green: safe to enter

• Texts without names or contact details, such as generic email templates and process descriptions
• Publicly available information
• Internal communication without personal data
• Brainstorms and ideas

Red: do not enter, not even in business accounts without a DPIA

• Names, addresses, email addresses or phone numbers of customers or staff
• Medical or health data
• Financial data of customers, such as account numbers, debts or loans
• Confidential contracts or quotes with customer information
• HR data such as performance reviews, sick leave or salaries

Put this on one A4 and share it with your team. One clear list does more than an extensive privacy policy that nobody reads.

Which safe alternatives exist for sensitive company data?

Sometimes you do want to work with sensitive data. There are better options than the standard ChatGPT environment.

Microsoft Copilot via Microsoft 365

If you already use Microsoft 365, Copilot is a logical choice. Your data stays within your company's Microsoft environment and falls under the existing data processing agreement. Handy for companies that already work in the Microsoft ecosystem.

Azure OpenAI or a private environment

For maximum control you can set up a private Azure OpenAI environment. Your data is then not shared with OpenAI and can stay within the EU. It takes more technical setup, but gives the strongest compliance guarantees.

Local AI models

For very sensitive data you can run models locally, so nothing leaves the organisation. They are less user-friendly, but give the most control for sectors with strict data rules.

Want to use AI on your own company data without it ending up at a consumer service? Then read how getting your data in order plays into that. For liability around customer data, see AI agents, GDPR and liability.

Which company rules can you introduce tomorrow?

You do not need to write a big policy to get started. Three steps that have an effect straight away:

1. Make a data classification list. One A4 with green and red data (see above). Share it by email or pin it up at the desks of people who use AI a lot.
2. Set a minimal AI usage policy. Two rules are enough for most SMEs: use only business accounts for work, and never enter customer or staff data without explicit approval from the manager.
3. Switch to ChatGPT Team. If your staff use ChatGPT regularly, Team is the simplest way to limit the biggest risks. The cost (about €23 per person per month) is small next to the risk of a data breach or GDPR fine.

Want to go through this with someone? Plan an introduction.

Frequently asked questions

Can I use ChatGPT at work with customer data?

Yes, but only with the right measures: a business plan (Team or Enterprise), a data processing agreement with OpenAI and clear rules for staff on which data they may enter. Without those steps you break the GDPR.

What are the GDPR risks of ChatGPT for companies?

The biggest risks are data shared with OpenAI without a legal basis, the lack of a data processing agreement and not doing a DPIA for large-scale AI use. The Dutch Data Protection Authority supervises this.

Is ChatGPT Team GDPR-proof?

Team is a step in the right direction: data is not used for training and you can sign a data processing agreement. Whether it is fully GDPR-proof depends on what you enter and how you regulate use internally. For sectors with strict requirements, like healthcare and finance, Enterprise or a private environment fits better.

How expensive is the switch to ChatGPT Team?

ChatGPT Team costs about €23 per user per month on an annual plan. For ten employees that is about €230 per month.

Which data should I never enter into ChatGPT?

Do not enter: names, addresses or contact details of customers or staff, medical data, financial customer data, confidential contracts and HR information like salaries or performance reviews. That goes for the free version and also for business accounts without data classification and a DPIA.

Sources

• Enterprise privacy at OpenAI, OpenAI
• Managing data, sharing, and privacy in ChatGPT Business, OpenAI Help Center
• General Data Protection Regulation (GDPR), EUR-Lex