ChatGPT at work and GDPR: what you can and cannot do

ChatGPT and similar AI tools are already used in most companies, often with no rules at all. The biggest risk is not the tool itself but staff pasting customer data, contracts or internal figures into it. With a few simple rules, AI can be used safely and in line with GDPR. This article is a practical guide, not legal advice: for specific situations, consult a lawyer or your data protection officer.

Where the problem is

When an employee pastes a customer email with a name, address and issue into a free, personal AI account, that personal data goes to an external provider. The company often has no legal basis for this, no data processing agreement with the provider, and no idea where the data is stored or whether it is used to train models.

Five rules for your team

1. Use business accounts, not personal ones. Business and API versions of major AI tools usually come with a data processing agreement and an option not to use your data for training. Check the provider’s terms.
2. Do not enter personal data you do not need. To help draft a reply, AI does not need the customer’s name, ID number or address. Replace them with “[customer]”.
3. Never enter special category data, such as health data, without a clear legal basis and safeguards.
4. A person checks everything that goes out. AI can be wrong or invent facts. A reply, quote or contract is always reviewed by an employee.
5. Write the rules down. A one-page internal document: which tools are allowed, what may be entered, and who is responsible.

What the EU AI Act brings

The EU AI Act sets obligations based on the risk of a system. For most small businesses the key one is transparency: when a customer talks to an AI chatbot or agent, they must know it is AI. High-risk uses, for example in hiring or credit scoring, carry much stricter obligations.

When your own AI system is better

If AI has to work with customer data every day, for example in customer support or document processing, it is safer to have a solution you control. Data stays in your system on EU servers, you know exactly what goes to the AI service, and every request is logged. That also makes it easier to show compliance if anyone asks.

How to start

List where your team uses AI today and with what data. It is a good starting point both for the rules and for deciding where a proper solution pays off. We go through this together in a free business diagnostic; read more on our AI automation page.