Is it safe to put company data into ChatGPT?

Default settings expose data to model training

The free version of ChatGPT and the Plus subscription (in their default configuration) grant the provider the right to analyse user conversations for the purpose of training future model iterations. A manual opt‑out exists in the user profile, but relying on individual discipline across an entire team is hazardous. Audits by the Czech Institute for AI and Data (CIAD) repeatedly show that the absence of a contractual training guarantee on standard accounts is the most frequent cause of sensitive information leaks in Czech organisations. The same pattern will appear in any jurisdiction where employees use consumer‑grade AI accounts for work.

Enterprise tier adds contractual guarantees and encryption

ChatGPT Enterprise and access via the API provide a contractual guarantee that no data from customer conversations will be used for model training. The enterprise version also encrypts data both in transit and at rest, satisfying stricter requirements under the General Data Protection Regulation (GDPR). For any organisation subject to GDPR, effectively every entity processing EU residents’ personal data, this distinction determines whether AI use can be compliant.

Categories that must never enter public AI tools

A company should enforce an absolute ban on submitting specific categories of information to any public AI tool, regardless of the version used. These categories include personal data of employees and clients such as names, national identification numbers and health records; trade secrets; unpublished financial results; passwords; API keys; and internal strategic documents. Even when training is disabled, data still traverses third‑party servers, expanding the attack surface for cyber incidents or provider‑side errors. The recommended safe practice is thorough anonymisation before any input: replace concrete company names, personal names and exact figures with generic placeholders such as “Client A” or “Project X”.

Technical and organisational controls for teams

Safe AI adoption requires a combination of technical enforcement and organisational policy. First, prohibit private accounts for work purposes and mandate a centrally managed enterprise account where the administrator has full control over privacy settings. Second, issue an internal directive that clearly defines which data may be processed and the exact anonymisation procedure staff must follow. Third, conduct regular training so employees understand that an AI tool is not a passive text editor but a complex system that processes data on remote servers.

What this means for organisations

Using the free version of ChatGPT for business purposes creates an unacceptable legal and reputational risk linked to potential trade secret disclosure. Secure work with AI is only possible with specialised enterprise licences that disable training on customer data, combined with rigorous adherence to data minimisation principles.