ChatGPT in the company: Data protection rules

ChatGPT can be used in a company in compliance with data protection regulations if three things come together: a company account with a data processing agreement instead of private accounts, clear rules about which data is allowed in the chat, and employees who are aware of these rules. Personal data of customers or employees and trade secrets do not belong without these basics.

ChatGPT has long been in use in many companies – often with private accounts, on the company laptop, with real customer emails. This is convenient, but risky. This article explains where the problem lies and how you can create clarity with simple rules.

Why private ChatGPT accounts are a problem in business

According to OpenAI, conversations can be used to improve the models for personal ChatGPT accounts as long as the "Improve the model for everyone" setting is not turned off in the data controls. Above all, however, the legal basis is missing: If an employee enters personal data into a private account, there is no data processing agreement between your company and the provider. For the GDPR, this is a transfer without a suitable basis.

In addition, there is the problem of shadow AI: no one knows which data goes where. How to get a grip on this is described in the article Shadow AI in the company.

Comparison of personal accounts and corporate offers

Feature	Private account (Free/Plus)	Enterprise offering (Business, Enterprise, API)
Training with your data	possible, can be switched off in the data controls	according to OpenAI, not by default
Data Processing Agreement	no	is offered
Management by the company	no	yes, central accounts and rights
Data storage in Europe	no	selectable for Enterprise, Edu and API

As of October 2026, according to OpenAI. Even with a company account, it remains to be checked whether the transfer to the USA is permissible for your data and how long data will be stored for security purposes.

The data traffic light: What is allowed in the chat?

A simple traffic light helps employees more than a long set of rules:

Traffic light	Examples	Rule
Green	public information, general questions, own texts without names	allowed
Yellow	internal processes, drafts without personal reference, anonymized examples	only in the shared enterprise tool
Red	Customer and patient data, personnel files, salaries, contracts, passwords, trade secrets	– except in a solution approved for this purpose with a suitable legal basis

Important: Anonymization means more than omitting the name. A combination of place of residence, age and diagnosis can also make a person recognizable.

Five rules for employees

Use only shared tools with a company account, no personal accounts.
Do not enter red data, not even "only briefly".
Check results before they go to customers – AI can invent facts.
AI content marks where customers interact with AI or see AI-generated content.
If you are unsure, ask: appoint a fixed contact person in the company.

These rules belong in a written AI guideline so that they apply equally to everyone.

Alternative: AI on your own servers

If you often work with sensitive data, you can operate your own AI chat, for example with Open WebUI and a language model from a German data center. Then the data does not leave your control. The article Open WebUI as a ChatGPT alternative shows what this looks like.

Rules alone are not enough: train

A policy that no one understands does not protect. Employees need to know what personal data is, why the account type is important and how to anonymize examples. This is exactly an integral part of our AI training for companies – with data traffic lights, exercises on your own cases and certificate of participation. In addition, the training supports your obligation under Art. 4 EU AI Act to take measures on AI competence.

Funding: Pure training is usually not subsidized by INQA coaching, because the program promotes consulting. If the AI introduction is accompanied as INQA coaching in its entirety, the federal government will cover 80% of the consulting costs of up to €1,200 per day for up to 12 days. The funding check shows which programs are suitable for you.

Frequently Asked Questions

Can you use ChatGPT in the company?

Yes, if the use is regulated: company account with a data processing agreement, clear rules for entering data and trained employees. Without these basics, no personal data should be entered.

Will my ChatGPT inputs be used for training?

According to OpenAI, conversations can be used for training on personal accounts, as long as the setting in the data controls is not disabled. According to OpenAI, data is not used for training by default for the business, enterprise and API business offerings.

What data is not allowed in ChatGPT?

Without a suitable legal basis, there is no personal data of customers, patients or employees, no contracts, passwords or trade secrets. A data traffic light helps employees to classify them.

Do I need a data processing agreement with OpenAI?

Yes, as soon as personal data is processed. OpenAI offers such a contract for its corporate offerings; it does not exist for private accounts.

Is there an alternative without US providers?

Yes, for example, a self-operated AI chat such as Open WebUI with language models from German data centers. Then the data remains under your control.

Sources: OpenAI Help Center "Data controls in ChatGPT"; OpenAI "Business data privacy, security, and compliance" (as of October 2026).

Using ChatGPT in the company in compliance with data protection regulations: What employees are allowed to enter