Personal ChatGPT at work: keeping control of company data

An employee wants to rewrite a client email, summarise a contract or understand an error. They open a personal ChatGPT account and paste the text. The task becomes easier, but the organisation may never have agreed to send that information to the service.

The first decision is about use: which information may leave the organisation, for which purpose and under which conditions? A ban that leaves the underlying task unresolved is difficult to apply consistently.

The account type affects the terms

OpenAI says content from individual services may be used to improve its models, with a setting to opt out. Training is disabled by default for its business offerings and API. Its data-use documentation explains the distinction.

Choosing a subscription still does not establish company policy. Review the agreement, account management, enabled features and document handling. A setting chosen by one employee cannot replace shared rules.

Start with tasks and classify the information

List actual uses: drafting, translation, development assistance and spreadsheet analysis. Identify the information required for each task and remove what is unnecessary. A fictional email may be enough to test whether a writing assistant is useful.

• Public material and invented examples provide a practical learning environment.
• Internal information requires an approved service and agreed conditions.
• Credentials, technical secrets and sensitive files need explicit restrictions and an appropriate process.

This is a proposed operating framework, to adapt to your organisation. Personal information remains subject to applicable obligations: the Swiss data-protection authority explains that existing data-protection law also applies to AI.

Write rules people can actually use

A short practical guide should identify the approved tool, show examples of permitted inputs, name a contact and explain how to report a mistake promptly. Training can use fictional correspondence rather than real customer records.

The Swiss federal campaign on workplace AI recommends employer-provided business tools and careful handling of submitted information. Turn those principles into examples that match your team’s tasks.

Put controls around a defined risk

Decide who manages accounts, how access is removed when someone leaves and who reviews new features. Evaluate technical controls against a specific risk with the relevant organisational and privacy responsibilities in mind.

If sensitive information has already been shared, preserve what is needed to understand the incident, inform the responsible person and replace exposed credentials immediately. Notification duties depend on the circumstances and require a specific assessment.

A useful next step is one task, one fictional dataset and one accountable owner. Compare services on that concrete basis, with explicit conditions for their use.