Blog · Published · Updated
Customer data in ChatGPT and Claude: prepare the document first
Short answer
Limit customer data before you send it to ChatGPT or Claude, because the instruction "anonymise it first" comes too late. Pasting a full document with that request already hands it to the vendor. A draft reply to a complaint usually needs only a description of the problem and a passage from the terms, with no name, address or order number. Removing a name is often pseudonymisation, which the GDPR still covers.
- net per day of closed training for the team
- from €1,150
- people in one training group
- up to 15
- after this time, we measure the effect on the same tasks
- 30 days
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
Personal data and AI: statistics 2026
48.8%
of EU enterprises that considered AI and did not use it named concerns about data protection and privacy, according to Eurostat (2025).
52.5%
According to Eurostat (2025), 52.5% of EU enterprises that considered AI and did not use it named a lack of clarity about the legal consequences.
49%
According to the European Commission (2026), 49% of EU SMEs and mid-caps name legal uncertainty as a barrier to AI.
Source: European Commission, Flash Eurobarometer 578 (2026) ↗
84%
According to the European Commission (2025), 84% of Europeans think AI requires careful management to protect privacy and ensure transparency in the workplace.
Source: European Commission, Special Eurobarometer 554 (2025) ↗
Figures checked: 22 October 2026
Limit the data before sending
A model is meant to help write a reply to a complaint. Does it need the customer's address, bank account number and two years of correspondence? Usually far less is enough. Pasting a full document with the instruction "anonymise it first" already hands that document to the vendor. The company has to approve that kind of processing in advance, and it is better to avoid it altogether.
An example: what to pass on for a draft reply
A draft reply about a damaged product. An employee checks it before it is sent.
| Element of the case | Needed for the draft? | What to do |
|---|---|---|
| First name, surname, email, address | Usually not | Remove; the employee fills in the recipient's details |
| Description of the damage | Yes | Keep the facts about the product, remove side information about people |
| Date of purchase and of the complaint | If it affects the reply | Only the necessary date or the time between them |
| Order number | Usually not | A local case reference, if the result must be linked to a record |
| Terms and conditions | The relevant passage | The version in force, with the source marked |
| The customer's whole mailbox | No | Only the messages of this case |
A task prepared this way has a clear result: a proposed reply, the source and the missing information. The employee still checks the facts, the authority to decide and whether the terms are current.
Removing a name is not always anonymisation
If the company keeps a table that links the case reference to the customer, the data is pseudonymised and the GDPR still covers it. That usefully limits exposure, but it removes no obligations. A person can also be recognised from details: a rare product, a date, a delivery place. The European Commission separates data that can be re-attributed from data that is irreversibly anonymous.
- Comments and change history in documents
- Hidden sheets, columns and range names in Excel
- Metadata: author, company, file paths
- Attachments embedded in PDFs and messages
- Text under a visual cover in a PDF
Check the finished material in the form in which it will be sent.
Three levels of preparing customer data for ChatGPT and Claude
A few cases a day, different employees
rules and a template with exercises
from €1,150
The team works on a private account
a company workspace with a data processing agreement
from $20 per person
Hundreds of cases, the same fields
an integration that passes only the fields needed
from €3,000
You do not know where data goes today
AI Act and GDPR audit
from €700
When preparing data by hand stops being enough
For a few cases, a template and the employee's check are enough. At higher volume, an integration fetches only the fields needed, prepares the material and saves the result for review. Such an integration also needs tests: content in a comment, data in an unusual format, a message with information about a third person. Automatic detection of personal data makes mistakes, so the result has to go through a check.
Measure the effect by the number of corrections, the time to prepare a case and the cases in which unneeded data was sent. A shorter prompt does not confirm that the whole process is correct.
The most common mistakes in a team
The first is pasting a whole email thread "for context", although the task concerns one message. The second is working on a private account because the company one "is not ready yet". The third is a screenshot from a system that shows other customers' data. All three disappear when the team has a task template and a company workspace it works in from day one.
How Syntalith helps
If the problem is that employees work in different ways, exercises in preparing documents are part of the ChatGPT or Claude rollout from €1,150 net for a team of up to 10 people. An AI audit for the AI Act and the GDPR costs from €700 net at Syntalith and ends with a register of AI tools, a list of settings to change and a training plan for the team. The company assesses the legal basis and the scope of data with its data protection officer or lawyer. Vendor details are in the articles ChatGPT and company data and Claude and GDPR.
Worked example · Scenario
How we count the payback: replies to customers
In the free analysis we also settle which data a reply really needs.
€5,817
a month for answering 2,000 customer emails
Payback: 0.6 mo.
5 minutes to read an email and write a reply and checking in 15% of the old time are our assumptions. €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat, for companies with 10 or more employees. Model cost: Claude Sonnet 5.5, about 3,000 + 600 tokens per message with a draft reply, at the ECB rate of 1.1205 USD per euro on 22 October 2026.
See the full calculation →
