ChatGPT at work: GDPR, the EU AI Act and a usage policy for your team
In most companies employees already use ChatGPT, often with private accounts and no rules. The risk isn't the tool but what gets pasted into it: customer data, quotes, HR matters. This article shows how to turn uncontrolled use into managed use, with the right plan, clear rules and the duties under the GDPR and the EU AI Act.
Private accounts are the real problem
With private accounts, inputs may be used to train models depending on settings, there's no data processing agreement with your company, and you have no overview of who entered what. OpenAI's business plans (ChatGPT Business and Enterprise) and the API are made for this: inputs are not used for training by default, there's a data processing agreement with OpenAI Ireland as the contracting party for the EEA, and accounts are managed centrally.
For Enterprise, Edu and the API, OpenAI also offers data residency in Europe. Check before signing whether it's available for your plan. The same applies to Microsoft Copilot, Google Gemini or Claude: what matters is the business plan with a contract, not the model.
What doesn't belong in it
Even with a business plan, draw clear lines. Without a separate review, don't enter:
- Personal data of customers, applicants or employees if the task doesn't need it; often replacing names with placeholders is enough.
- Health data and other special categories under Article 9 GDPR.
- Trade secrets, unpublished figures, credentials.
- Data covered by a duty of confidentiality.
Duties under the AI Act
Under Article 4 of the AI Act, organisations deploying AI systems must take measures to support the AI literacy of staff working with them. The 2026 Digital Omnibus softened this duty but did not remove it. In practice: a short training on how the tools work, their limits and typical errors, plus a documented policy.
Since August 2026, AI-generated text published to inform the public on matters of public interest must be labelled unless a person has reviewed it editorially. For ordinary marketing copy that an employee reviews and takes responsibility for, that's rarely relevant.
A one-page usage policy
A good policy is short enough to be read. It answers:
- Which tools are allowed with which account, and that private accounts are off-limits for company data.
- Which data must not be entered, with examples from your daily work.
- That results must be checked before they go to customers; AI invents facts, sources and figures.
- Who to contact with questions and requests for new tools.
Privacy documentation and works council
Add the use to your record of processing activities, sign the processing agreement and check whether certain uses need a data protection impact assessment, for example analyses about employees. If you have a works council in Germany, involve it early: tools that can monitor employee behaviour or performance are subject to co-determination under Section 87(1) no. 6 of the Works Constitution Act. We help with tool selection, policy and training as part of our consulting from €60 per hour.
Frequently asked questions
- Can ChatGPT be used in a GDPR-compliant way at all?
- Yes, with a business plan, a processing agreement and clear rules on which data is entered. The main issue is using private accounts for company data.
- Can we simply ban ChatGPT?
- You can, but bans are often worked around. An approved tool with clear rules usually protects data better than a ban nobody enforces.
- Does everyone need AI training?
- Everyone who uses AI tools at work should be covered by AI literacy measures. A short, documented training with examples from your business is usually enough to start.
Sources
Tell us what your team uses AI for today. We propose tool, plan and a one-page policy and train the team with examples from your daily work.
Set rules for AI use