Is it safe to put company information into ChatGPT?
Putting company information into ChatGPT can be safe or risky depending on which plan you use and what you type. According to OpenAI's own page, content from individual accounts may be used to train models, while content from business plans and the API is not used by default. For data such as a customer list, a payroll file or a quotation, the real question is not "is ChatGPT safe?" but "which account, which setting, which data?"
If the topic is new to you, think of it this way: every piece of text typed into ChatGPT travels to servers run by a provider outside your company. How long it stays there, who can see it and whether it helps train new models depend on the contract and the account settings. The same text has one outcome in an employee's personal account and another in the company's business plan.
There are three doors, and in most companies all three are open at once:
- Individual accounts. OpenAI's page on how data is used to improve model performance (updated 13 March 2026) says that content from services for individuals may be used to train models, that users can opt out, and that Temporary Chat conversations are not used for training.
- Business plans. The same page and OpenAI's business data privacy page state that inputs and outputs from plans such as ChatGPT Business and Enterprise are not used for training by default.
- The API. The API data documentation says that data sent to the API is not used to train models, that abuse-monitoring logs are kept for up to 30 days by default, and that zero data retention needs OpenAI's prior approval.
These terms can change, so check the current pages and your own contract before you decide.
Which company data can go into ChatGPT, and which cannot?
It helps to sort data into three groups: free, conditional and forbidden. The table below is a starting proposal; settle the final version with your legal and information security teams.
| Data type | Individual account | Approved business tool |
|---|---|---|
| Public information, general questions | Allowed | Allowed |
| Customer list, names and contact details | Do not enter | Conditional: after a KVKK assessment |
| Salary, HR file, health information | Do not enter | Do not enter; separate approval if essential |
| Contract and quotation text | Do not enter | Conditional: depends on confidentiality terms |
| Source code, API keys, passwords | Do not enter | Code conditional; keys and passwords never |
| Anonymised, generalised text | Conditional: training setting off | Allowed |
The Turkish data protection authority's Generative AI and Personal Data Protection Guide specifically mentions the risk that personal data and commercially sensitive information shared in prompts may be exposed. It recommends using anonymised and generalised wording where possible when sharing information with these systems, and not sharing other people's personal data.
How is using ChatGPT assessed under KVKK?
When an employee types a customer's name and complaint into ChatGPT, your company has processed personal data. As the data controller, you need to assess the lawfulness of that processing, the information notices and the security measures. Even if the account is personal, responsibility can return to the company when the work is done on its behalf.
Under Law No. 6698, at least three articles may be relevant:
- Article 10, information notice. Customers and employees may need to be told for what purpose their data is processed and to whom it is transferred.
- Article 12, data security. The controller is expected to take appropriate technical and administrative measures against unlawful processing of and access to personal data. A rule on which tool employees may use for what can be considered part of those measures.
- Article 9, transfers abroad. If the provider is outside Turkey, personal data in a prompt may count as transferred abroad, and one of the conditions in the Law may need to be met. Check the current regulation and Board decisions.
For trade secrets that contain no personal data (a price list, a strategy deck), contracts and internal policies decide, not KVKK. If a customer contract has a confidentiality clause, uploading that content to a third-party service may conflict with it. Ask your lawyer when assessing contract texts.
What steps make ChatGPT safer to use with company data?
A ban often pushes employees towards personal accounts. A more durable approach is to write the rule and provide an approved tool. Five steps are enough to start.
- Write down the data classes. Adapt the table above to your own data: free, conditional, forbidden. Add one example for each class.
- Choose an approved account type. This could be a business plan or your own application built on the API. Confirm training, retention and processing location in writing.
- Put individual accounts out of scope. State in the rule that personal accounts must not be used for work data. Where unavoidable, require that the training setting is switched off.
- Clean data before sending it. Remove or replace names, ID numbers, amounts and company names with generic wording. The KVKK guide points the same way.
- Train people. The rule should not be a one-off email: explain it to new starters in week one and review it yearly. Say who to contact to report a breach.
If data must never leave the company, there is a third option: running the model on your own server. Then no data goes to a cloud supplier, but you carry the set-up and operating responsibility. You can find the comparison in our guide to building a private ChatGPT on company data.
For example: what should a sales team do when writing quotations?
For example, suppose a sales team of 12 has ChatGPT write the quotation texts it sends to customers. Each quotation contains the customer's name, the contact's name, product lines and a discount rate. All figures in this example are hypothetical.
In the first case, the team pastes the whole quotation using personal accounts. The contact's name and details are personal data, and the discount rate may be a trade secret. If the training setting is on in the account, the text may be used to improve models.
In the second case, the manager makes three changes. The company buys a business plan and gives the team that account. The quotation template keeps "[Customer]", "[Contact]" and "[Rate]" as placeholders; ChatGPT only edits the wording, and the real values are added by hand afterwards. The rule is written on one page and the team is briefed once.
The result: the team works at the same speed, but personal data and pricing do not leave the company. The cost is one licence and half a day of training.
How do you know the rule is working?
A written rule is not enough on its own; you need to see whether it is followed. Even for a small company, these four checks are reasonable:
- Ask which tools are in use. Run an anonymous survey asking staff which AI tools they use and with which account. If you ask without judging, you will see the real picture.
- Audit the approved account's settings. Check training, retention and sharing settings in the admin panel every three months. If the supplier's terms have changed, update your rule too.
- Review sample prompts. In the approved tool, with staff consent and as far as the business plan allows, review a few sample prompts to see whether a forbidden data class slipped through.
- Rehearse the incident procedure. If someone pastes a customer list by mistake, who is told and what are the steps? Walk through it once at a table.
None of this requires building a monitoring system. Because monitoring employees' prompts can itself count as processing personal data, settle the purpose, scope and notice with your legal team first if you are considering it.
It also helps to name one person who owns the rule. Without an owner, the table of data classes ages quickly: new tools appear, supplier terms change, and staff stop knowing where the line is. A short review every quarter, with the owner, a manager from IT and someone from legal, is usually enough to keep the rule current.
What mistakes do companies most often make with ChatGPT?
- Only banning it. Without an approved alternative, staff move to personal accounts and the company cannot see what is typed.
- Not separating account types. Assuming the terms of an individual account apply to a business plan, or the other way round.
- Trusting the marketing page. Not confirming training, retention and processing location in the contract and official documents.
- Forgetting the confidentiality clause in customer contracts. Even without personal data, content may not be allowed to go to a third-party service.
- Pasting keys and passwords with code. Even a single leak means they must be replaced.
- Not checking the output. The company stays responsible for wrong information; a person should read the reply before it is sent.
How Hatson Tech helps
As part of AI consulting, Hatson Tech helps you map which company data may go to which tool and write your usage rule. Where needed, we can run the model on your own servers and build an internal assistant without sending data outside the company. The first meeting and discovery are free; we do not publish fixed prices, and we agree the scope together after discovery.
For more, see our KVKK generative AI guide and our article on data privacy in AI.