HomeAI and data protection
May I use ChatGPT in the company? Using AI at work without risking data protection.
In many companies, employees already use AI, often with private accounts. The GDPR does not prohibit AI. But it requires you to know which data goes where. Here are the key points and the way to clear rules.
As of October 2026, checked against the text of the regulation. General information, not legal advice.
What the GDPR requires
As soon as personal data enters an AI tool, the usual data protection rules apply.
-
A legal basis
Personal data such as names, email addresses, personnel or customer data may only be processed if there is a basis for it under Art. 6 GDPR.
-
A contract with the provider
For most uses a data processing agreement under Art. 28 GDPR is needed. Business versions offer one, private accounts as a rule do not.
-
Clarity about servers in third countries
Many providers process data in the USA. The basis is currently usually the EU-US Data Privacy Framework, which is under review before the Court of Justice of the European Union. Where possible, keeping data in the EU is the more robust choice.
-
Information and risk assessment
Privacy notices must cover the use. For sensitive data or large volumes a data protection impact assessment may be necessary.
-
Works council
If there is a works council, it generally has to be involved for systems that can record performance or behaviour.
Private account or business version
The biggest difference lies not in the model but in the contract behind it.
- Private and free accounts: inputs may be used for training, depending on the settings. There is no data processing agreement, and the company has no overview.
- Business versions of ChatGPT, Copilot and comparable services: the providers undertake not to use inputs for training by default, and offer a data processing agreement, central administration and in some cases data storage in the EU.
- Own solutions: AI models via an interface or on servers in the EU, connected to your own documents and respecting your access rights.
Providers' contract terms change frequently. Check the current version before introduction.
What does not belong in the chat window
As long as there is no approved solution with a suitable contract, this data is off limits.
- Personnel data, job applications and health data.
- Customer data with names, addresses or contract details.
- Passwords, credentials and keys, including in code or logs.
- Confidential contracts, quotations and trade secrets.
How to regulate this in an understandable way is shown on our page about the AI policy for companies.
Where we help From uncertainty to clear rules and safe tools.
-
Taking stock
Which AI tools are already used in the company, with which data and for what.
-
The right tool
We recommend a solution that suits your data and set it up: a business version, a solution on EU servers or your own AI agent for your documents.
-
AI policy
Together with you we draft clear, short rules for your employees' daily work.
General information, not legal advice.
Frequently asked questions about AI and data protection
Is ChatGPT GDPR compliant?
That cannot be said across the board. What matters is the version, the contract with the provider and which data is entered. With a business version, a data processing agreement and clear rules, use that respects data protection is possible in many cases.
May employees enter customer data into ChatGPT?
Not with private accounts. With an approved business version and a suitable contract it can be permissible if there is a legal basis. Where possible, names and other personal references should be removed beforehand.
Is Microsoft Copilot safer?
Copilot in Microsoft 365 runs within your company account and under contract. But it sees everything a user is allowed to see. Overly broad access rights to file storage and mailboxes should therefore be tidied up beforehand.
Do we need an AI policy?
No law expressly requires one. But it is the simplest way for employees to know what is allowed, and for the company to show that it has regulated the use.
What about the EU AI Act?
It applies in addition to the GDPR and sets its own requirements, for example on transparency and on the handling of AI systems. We clarify in AI consulting which of them concern your company. Our page on the AI Act gives an overview.
How is AI used in your company today?
Send us a few sentences. We will reply personally, free of charge and without obligation.
As of October 2026, checked against the text of the regulation. General information, not legal advice.