ChatGPTA support lead has six minutes before a customer call. She copies the full ticket history into ChatGPT and asks for a calm summary. The history contains the customer's name, email address, order number, refund amount and a request for sick leave that came up in the thread.
An HR manager wants a paragraph in a performance review to read more clearly. He pastes the draft into his personal ChatGPT account. It contains the employee's name, salary band and record of warnings, plus a note from a conversation with occupational health.
Neither of them is trying to leak data. Both are trying to work faster. That is what makes the privacy risk of ChatGPT hard to manage: the risky action feels like ordinary work.
The risky moment comes before ChatGPT answers
Most organisations discuss ChatGPT risk as if the problem starts with the model. Will it train on our data? Will it hallucinate? Will it expose our files?
Those are real questions, but they come second. The first risk is the paste. Once an employee has copied a customer record, a contract extract, an HR note, a source file, a screenshot or a spreadsheet into the prompt box, the organisation is already processing that data. The answer may be useful. The input may still have been more than the task needed.
So a good ChatGPT policy cannot stop at "use the business version" or "turn off training". The better question is what the employee sent to the tool, and whether the tool needed that much context.
Where a ChatGPT prompt can travel
What happens to a prompt depends on the workspace, the feature and the type of account.
| ChatGPT context | Training default | Visibility and retention risk | Admin control |
|---|---|---|---|
| Personal Free, Go, Plus or Pro workspace | Chats may be used to improve the model unless the user turns this off | Chat history, memory, shared links, file uploads and personal connected apps are controlled by the individual user | No organisation-level control |
| ChatGPT Business | Workspace data excluded from training by default | Workspace admins can view and export conversations: what your employer can see in ChatGPT | Workspace owners and admins manage members, apps, GPT controls, usage settings and SSO |
| ChatGPT Enterprise or Edu | Workspace data excluded from training by default | More options for SCIM, RBAC, data controls, app permissions and retention or residency, depending on the plan | Strongest central control |
| Temporary Chat | Not used for model training | Does not appear in history or create memories, but copies may be kept for up to 30 days for safety review | Useful for individuals, not a complete governance model |
The practical lesson: "ChatGPT" is not a single privacy setting. A prompt in a personal account, a Business workspace, an Enterprise workspace, a temporary chat, a GPT with actions or a connected app is handled differently in each case. According to OpenAI's enterprise privacy page, the same training default applies to ChatGPT for Healthcare and ChatGPT for Teachers.
Seven ways data leaks into ChatGPT
1. Raw records pasted in to be summarised. This is the everyday case. A support thread, intake form, patient note, complaint, order record or incident report goes in so ChatGPT can summarise it. To do that, the model rarely needs the real name, email address, phone number, account ID, national ID number (such as the Dutch BSN) or the full chronology.
2. Files uploaded because copying and pasting is too much effort. Uploading a file feels safer because it is tidier. It is not necessarily safer. A PDF, CSV, Word document, contract bundle or exported ticket file can contain hidden metadata, tracked changes, comments, extra sheets or rows beyond the part the employee meant to share.
3. Screenshots that show more than the problem. Employees upload screenshots to get help with an error, an invoice, a dashboard or an email. The problem itself may be harmless. The side panel, browser tab, notification banner, URL, customer row or account name may not be.
4. Memory turning one prompt into context for later. Memory can make ChatGPT more useful, but it means a conversation no longer stays within its own boundaries. Sensitive facts that are remembered can shape later answers.
5. GPTs, apps and connectors taking data further. A prompt can call a GPT, an app or a connector. That may be exactly what the user wants, but it also means data can be sent to or fetched from another system. In a managed workspace, admins should decide which apps are allowed and who may use them.
6. Shared links as a quick way to collaborate. Shared links are convenient and easy to misunderstand. A link from a personal account shows the conversation to anyone who has it, including details the sender forgot were in there. Shared ChatGPT chats briefly became findable in search engines in 2025 (see the incidents below). Three weeks later, hundreds of thousands of shared Grok chats turned up in Google, as described in our article on Grok's privacy risks at work.
7. Personal accounts used for real work. This is the quietest risk. The employee is not going around IT out of recklessness; ChatGPT is already open, so the work goes there. But a personal workspace has its own settings, its own shared links and its own memory, and no central offboarding or audit.
The bill when it goes wrong
Under the GDPR, a ChatGPT prompt can contain personal data just as an email, a spreadsheet or a ticket system can. If the prompt identifies a person, the organisation needs a lawful basis, a purpose, data minimisation, suitable processor terms where relevant and a way to answer basic questions later: what was shared, why and under whose control?
The risk goes beyond regulation. A pasted contract extract can give away a negotiating position. A support record can expose a vulnerable customer. A source file can contain credentials. A screenshot can show the name of a production incident. A performance review can reveal special category data or details from occupational health.
The uncomfortable part is that these prompts usually come from good employees doing useful work. That is exactly why policy alone does not catch them.
What has already gone wrong with ChatGPT
March 2023: ChatGPT history and payment-data bug
OpenAI took ChatGPT offline after a bug in an open-source library let some users see the titles of other active users' chat histories. OpenAI later reported that the same bug may also have exposed payment-related information of 1.2% of ChatGPT Plus subscribers who were active during a nine-hour window. Source: OpenAI, March 2023.
April and May 2023: Samsung restricts generative AI after internal leaks
Samsung temporarily restricted the use of generative AI on company devices after employees pasted sensitive internal information into ChatGPT, including source code and a recorded meeting they wanted turned into minutes. The nuance matters: ChatGPT did not "hack" Samsung; employees used a public AI tool for real work without adequate controls. Sources: Engadget, April 2023 and TechCrunch, May 2023.
2023 to 2026: Italy's data protection authority and the court
Italy's data protection authority temporarily restricted ChatGPT's data processing in March 2023 while it investigated privacy concerns. In December 2024 it announced a fine of 15 million euros against OpenAI, finding among other things that OpenAI had trained ChatGPT on personal data without an adequate legal basis and had not reported the March 2023 breach. In March 2026 the Court of Rome upheld an appeal against that decision, and the authority has temporarily removed it from its website. Source: Garante, December 2024, with the note on the judgment.
July 2025: shared ChatGPT conversations indexed by search engines
Shared ChatGPT conversations were found in search results. Hours after TechCrunch reported it, OpenAI said it had removed the discoverability feature, describing it as a short-lived experiment that created too many opportunities for people to share things by accident. The lesson for workplaces is plain: sharing a link is a decision to publish, not a private note. Source: TechCrunch, July 2025.
These incidents point to different ways things fail: software bugs, what employees paste, regulatory uncertainty and sharing settings. A serious ChatGPT rollout has to allow for all four.
What to agree with employees
People use ChatGPT because it saves them time on real work. The rules that keep it workable fit on one page. Agree on three things:
- Which account. Work goes into the organisation's ChatGPT Business, Enterprise or Edu workspace, not into a personal account in another tab.
- Which data stays out. Name it: customer and patient names, customer numbers, health details, HR records, contracts, passwords and access tokens. If a task needs a detail, a placeholder usually does the job. Our guide to what you can and cannot share with AI has a longer list.
- How you check. Say what you look at, how and why, before you start. The next section covers the options.
In the Netherlands, the regulator has linked these rules to breach notification. On 6 August 2024 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) warned that it had received several reports of employees entering patient or customer data into AI chatbots. If an employee enters personal data against the employer's rules, the Authority treats it as a data breach, and notifying the Authority and the people affected is often mandatory. Where chatbot use is part of company policy, it is not a breach, but it is often still not lawful.
If your organisation has a works council, talk to it before you roll out any monitoring. Under Article 27(1)(l) of the Dutch Works Councils Act, the council has a right of consent over arrangements for facilities aimed at or suitable for monitoring employees' attendance, behaviour or performance. Whether a tool that shows ChatGPT use falls within that depends on what it can see.
How to see what employees share
Rules only help if you know whether they are followed. There are three routes, and they differ in how much they read.
Read the conversations. In ChatGPT Enterprise and Edu, the workspace owner can grant access to conversation logs through OpenAI's Compliance API and feed them into eDiscovery, DLP or SIEM tools. It covers activity in that workspace.
Check what leaves the device. On managed laptops onboarded to Microsoft Purview, DSPM for AI shows when someone pastes sensitive information, such as a card number, into ChatGPT, and endpoint DLP can warn or block. The prompt itself is only kept if a collection policy captures content. Through a SASE or SSE integration, Purview can also detect this in network traffic.
Count instead of read. The third route records how often sensitive data comes up in prompts, which kinds and in which tools, but not the text. You learn where the rules are not being followed, not what anyone wrote. BeeSensible works this way: its dashboard shows counts and patterns, never what someone typed.
Which route fits depends on what you need to know. Under the GDPR, as the Authority explains it, monitoring has to be necessary: if a less intrusive method achieves the same aim, you use that one. You also tell employees in advance what is allowed and that checks are possible: why, when and how you check, and which data is involved (conditions for monitoring employees, in Dutch). Our article on monitoring AI use at work covers what an employer may and may not do.
The ChatGPT settings that actually do something
Six settings and admin decisions are worth reviewing before ChatGPT is used widely at work.
1. Move work from personal accounts to a managed workspace Use ChatGPT Business, Enterprise or Edu for work. A managed workspace gives the organisation one place to set rules for apps, GPTs, members and sharing.
2. Turn off model improvement in personal accounts Where personal accounts are still in use, turn off Improve the model for everyone under Settings > Data controls. Our guide to turning off ChatGPT training gives the steps for each device.
3. Use Temporary Chat for sensitive one-off tasks Temporary Chat can be started from a new chat. It does not appear in history, does not create or update memories and is not used for model training. OpenAI does say copies may be kept for up to 30 days for safety purposes (OpenAI on temporary chat), so do not treat it as a secure vault.
4. Review memory Deleting a chat does not always delete a memory saved from it, so check what is stored; our article on how AI memory works shows where to look.
5. Audit shared links Go to Settings > Data controls > Shared links > Manage. Delete links that contain work content, personal data or confidential context. Links created in a Business, Enterprise or Edu workspace only open for members of that workspace, but they can include messages added after the link was shared (OpenAI on shared links).
6. Restrict apps, GPTs and connectors In ChatGPT Business, many apps are switched on by default; new Enterprise and Edu workspaces start with a limited selection. Admins decide which apps remain available and for which roles (OpenAI on apps).
Steps checked on 20 October 2026 against the OpenAI Help Center.
Where the settings stop
Settings decide how ChatGPT handles data once it arrives. They do not decide whether the employee should have pasted the data in the first place.
No training opt-out removes an unnecessary customer number from a prompt. No Temporary Chat setting tells a support agent that a medical note has nothing to do with a refund summary. No Enterprise workspace knows that a screenshot shows a client's name in the browser tab.
The gap is the few seconds before the prompt is sent, while the employee is still writing and can still mask or remove the sensitive parts.
Just before the prompt goes
BeeSensible checks text fields in the browser for personal data while the prompt is still being written. The text goes to BeeSensible's detection service in the EU, where it is analysed in memory and discarded straight after detection. In ChatGPT, names, email addresses, phone numbers, IBANs, BSNs, payment card details and other configured categories can be highlighted before the employee presses Enter.
The employee can mask the value with a placeholder or remove it.
In ChatGPT the organisation can also switch on masking on paste, on attach and on send. With Keep context, the extension puts the real values back into the answer on the employee's screen, while ChatGPT only ever sees the placeholders.
