Is ChatGPT safe for company data?

The question "Is ChatGPT safe for company data?" has no answer that applies to every account. The decision depends on the product, contract, configuration, data class, access rules, connectors, retention, and the action the output can trigger.

Start with the data and workflow. Then select an account or API path that gives the company the controls it needs.

For the team rollout, workspace versus API decision and pilot preparation, see our guide to introducing ChatGPT and OpenAI at work.

Start with the workspace and data class

Classify the material before writing a tool rule:

The classification should answer who may use the data, where it may be processed, how long the result remains, and what happens if the model produces an error. A banner that says "AI approved" cannot answer those questions.

Business plans and API have different controls

OpenAI's enterprise privacy page states that business inputs and outputs are not used to train models by default, that customers own or control their data where law allows, and that access and retention controls vary by product. The business data page describes security and compliance information for business products and the API.

Read the current terms for the exact product. Compare:

• identity and admin controls;
• retention and deletion behavior;
• connected apps and source permissions;
• audit and export options;
• data residency and transfer conditions;
• model or feature availability; and
• support and incident handling.

An API integration has a different data flow from an employee using a chat workspace. Document the prompts, outputs, logs, providers, and downstream systems for each path.

Individual accounts need a separate rule

Employees often use personal accounts because they are convenient. A company cannot assume that the personal account has the same ownership, retention, access, DPA, or deletion controls as the approved business environment.

Write a short rule that says which account may receive which data, how staff should redact or minimise content, and where an employee sends a question that needs a company source. Give people a supported route. A prohibition without an approved alternative tends to create shadow use.

Set retention and access before rollout

Decide whether conversation history, uploaded files, generated outputs, and tool traces must be retained. Set the access roles for administrators, managers, security staff, and the employee who created the conversation. Define how a departure, data-subject request, or incident affects stored content and exports.

Review connectors with the same care as the chat. A connected drive, CRM, or mail account can widen the data surface beyond what a user expected. Permission checks should follow the source system's policy, and the output should retain a link or locator where a reviewer can verify it.

The GDPR text is the primary source for personal-data obligations. The organisation still needs a purpose, minimisation, access, retention, and processor assessment for its own use.

Test the actual workflow

Before rollout, test representative tasks with approved and denied data. Include missing sources, conflicting instructions, a connected document the user cannot open, an output that contains an incorrect field, and a request to send or update a record.

Check that staff can identify generated text, verify the source, correct the result, and escalate an incident. Measure access enforcement, source correctness, correction time, and the actions that require human approval.

Keep high-consequence outbound messages and record changes behind approval. A model may draft a response. The accountable person or system rule must decide whether it is sent or committed.

Turn the policy into a working process

If the environment is approved and staff need practice, Syntalith team training starts at €600 net per day. Agreed exercises can cover preparing inputs, checking sources and deciding whether an answer is ready for use.

If the data flow and access requirements need defining first, an AI process audit starts at €600 net. Its core deliverables are a process map, architecture, implementation plan and fixed build quote. We agree the review scope in the offer. Licences and integrations are separate costs; the client's appropriate specialist approves the legal assessment. A free 30-minute scan helps establish the next step.

These guides examine the individual decisions:

• Personal ChatGPT or Claude accounts and company data
• Training opt-out: what still needs checking
• Preparing customer documents before using AI
• Shadow AI: review accounts and move to a company environment

Service prices and these links checked on 30 September 2026. Use the official OpenAI business data materials alongside the terms and DPA covering your chosen service.

FAQ

Does no-training-by-default mean the workflow is safe? It addresses one data-use question. Access, retention, connectors, prompt content, output quality, employee practice, and downstream actions still need controls.

Can we connect company files to ChatGPT? Only after checking the source permissions, plan controls, retention, and the data flow. Start with a limited source set and a test user group.

Should every employee receive the same access? Access should follow the work and source policy. Use the smallest workspace, connector, and feature scope that supports the task.

Sources

• OpenAI: Enterprise privacy
• OpenAI: Business data privacy, security, and compliance
• GDPR, Regulation (EU) 2016/679