Personal ChatGPT or Claude at work: who controls company data?
An employee has an AI subscription. Can they upload a customer contract or CRM export? Understand the account, confidentiality and GDPR decisions first.
Syntalith
An employee pays for ChatGPT Plus or Claude Pro and wants to answer a customer faster. They paste an entire complaint into a conversation, including a name, address and contract terms. The company has not approved the tool, agreed a data policy or recorded where that copy will remain. The employee's paid subscription does not settle those decisions.
A useful company rule is to keep customer data, employee data and confidential documents out of personal AI accounts until the company approves the specific workflow. France's data protection authority, CNIL, advises against entering this information into consumer generative AI services. That is not a finding that every business use of ChatGPT breaches GDPR. The data, purpose, service terms and safeguards matter. CNIL guidance
Company information is not always personal data
A confidential wholesale price list without information about individuals may fall outside GDPR. A complaint identifying a customer contains personal data. A named work email can identify an individual too. Commercial confidentiality and contractual obligations still need attention when a document contains no personal data. European Commission explanation
This distinction changes the deployment decision. “No personal data” does not authorise an employee to upload a product's entire technical specification. A public service description, meanwhile, does not require the same assessment as an employee file.
Does a Plus or Pro subscription solve the problem?
An individual subscription provides the features and limits in its offer. The company still needs to approve the processing arrangement, account ownership, access and deletion procedures, and any connected sources.
| Proposed use | Decision before work starts |
|---|---|
| Draft a public post without confidential information | Approve the tool and the way staff review its output |
| Paste a customer complaint into a personal account | Pause the transfer and choose an approved workflow |
| Analyse documents in a business workspace | Check contractual scope, permissions, retention and lawful basis |
| Connect a whole drive or mailbox | Review the actual reach of that connection before granting access |
OpenAI does not train on business service and API data by default. Anthropic sets out separate rules for its commercial services. Those protections matter, alongside the controls for the company's own workflow. OpenAI, Anthropic
A better route for the customer complaint
In the opening example, the employee needs a draft that follows the company's returns policy. The model may not need a name, phone number or full order history. The team can prepare a description with unnecessary details removed, provide the approved policy extract and ask for a draft with a source reference. A person checks it before sending.
If personal data is necessary, the work needs an approved environment and a defined scope. Removing a name alone does not make a complaint anonymous. An order number or unusual combination of details may still identify the customer.
Acceptance checks can be concrete: the tool uses the correct policy, a user cannot retrieve a document beyond their permissions, and sending a reply requires approval. These checks establish whether the workflow behaves as intended.
What the company gets, and what Syntalith costs
Staff know which environment to use and what they may submit. The company can assign responsibility for settings and remove access when someone leaves. Customer work becomes less dependent on a single employee's personal subscription.
Syntalith starts with a free 30-minute process scan. If the task needs closer analysis, our AI process audit starts at €600 net. The core deliverables are a process map, architecture, implementation plan and fixed build quote. We agree the account and data-flow review scope in the offer. This is a technical and process engagement, not a legal GDPR audit.
Team training starts at €600 net per day. Engineers who build AI systems teach staff through agreed work examples. Licences and integrations are separate costs. The client retains responsibility for approving the legal basis and processing arrangement, with its DPO or legal adviser where needed.
For the first conversation, bring the task description, user count and names of the tools already in use. We do not need customer documents to discuss a possible engagement.
Related decisions
- What disabling model training does and does not change
- How to prepare customer data before using AI
- Moving personal AI use into a managed company rollout
Sources and service prices checked on 30 September 2026. Whether a particular use is permissible depends on its circumstances, not the product name alone.
Syntalith is an OpenAI Select Partner in the OpenAI Partner Network.
We help your team respond to customers faster and find information in company documents. We choose and set up the right AI tools, then teach your team how to use them.
How to introduce ChatGPT and OpenAI at workFree process scan
Start with a free process scan.
- A 30-minute call with the engineer who would lead the work.
- A review of the processes that cost you the most time and money.
- A written summary: a possible direction, missing information and the next step.
The scan chooses one process to assess, and within 2 business days you receive a recommendation, including when a simpler route is the better fit.
€0
30 minutes · written takeaway within 2 business days
Times are shown in your own time zone. We work with clients across time zones.
Describe the process in the form