The shadow-use problem
In most companies ChatGPT arrived bottom-up: employees discovered it saves time and started using personal accounts for work. That is shadow use, and the risk is real: customer data and confidential documents flowing into tools nobody vetted.
Free versus business accounts
On consumer accounts, conversations may be used to improve OpenAI’s models. For business data that is unacceptable. The business tiers (Team and Enterprise) exclude your data from training by default and add admin controls, centralized billing and access management. Step one is simply moving your team off personal accounts.
Safe to share
Text without personal data, public information and anonymized examples are almost always fine: a proposal outline, a marketing draft, a summary of a public report.
Not safe to share
Customer and employee personal data, medical and financial records, passwords and API keys, and anything under NDA. For personal data, privacy laws such as state privacy acts and, for European customers, the GDPR apply. Anonymize where you can: most questions work just as well without names attached.
Make the safe path the easy path
Rules only work when the compliant option is also the convenient one. Provide a proper business workspace, share strong example prompts for your kind of work, and appoint one colleague as the go-to person. Put the rules in a short AI policy everyone can find.
FAQ
Can my employer see my ChatGPT conversations?
On Team and Enterprise plans, workspace admins have compliance and management capabilities. Assume work accounts are work property and keep personal use separate.
Is ChatGPT GDPR or CCPA compliant?
The enterprise offerings provide data processing agreements and controls that support compliance, but compliance is something your company achieves through how it uses the tool, not something a tool is by itself.
Should we just block ChatGPT?
Blocking usually drives use underground on personal phones. Channeling use into an approved, well-configured workspace is safer and more productive.