How to use ChatGPT in a GDPR-compliant way
ChatGPT, Copilot, Claude and Gemini are useful for writing a letter, summarising a file or answering a customer question. But what happens to the names, addresses and numbers you paste in? And is that even allowed under the GDPR? This article explains the rules and how to use AI chatbots without privacy risks.
What do regulators say?
On 6 August 2024 the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) warned that using AI chatbots can lead to data breaches. It had received several reports. In one case, an employee of a GP practice had entered patients' medical data into an AI chatbot, against the practice's rules. In another, an employee of a telecom company had entered a file containing, among other things, customer addresses.
The authority pointed out that most chatbot providers store the data entered. If an employee uses a chatbot against the employer's rules and enters personal data, it considers this a data breach. If the organisation does allow it, it is not a breach, but often still not lawful.
Which GDPR rules apply?
- Lawful basis (Article 6 GDPR): sharing personal data with an AI provider requires a valid legal basis. "It was convenient" is not one.
- Data minimisation (Article 5(1)(c)): you may not process more data than necessary. Improving the wording of a letter does not require real names.
- Special category data (Article 9): health, religion, ethnicity and similar data may in principle not be processed, except under specific exemptions.
- Processor agreement (Article 28): if an organisation processes personal data through an external service, it needs a contract with that service.
- Transfers outside the EU (Articles 44 onwards): many AI providers are American. Transfers require appropriate safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.
- Data breaches (Articles 33 and 34): if things go wrong, a breach must in many cases be reported to the supervisory authority within 72 hours.
7 rules for using ChatGPT under the GDPR
1. Anonymise or pseudonymise before you paste
The most important rule: don't paste identifiable personal data into a chatbot. First replace names, ID numbers, IBANs, addresses, phone numbers and case numbers with labels. VerumVault does this locally in your browser and lets you put the real data back into the answer afterwards.
2. Leave out special category data
Health, diagnoses, religion or criminal records do not belong in a public chatbot. Describe the situation in general terms ("an employee is on long-term sick leave") if that is enough for your question.
3. Watch out for indirect identifiers
Even without a name, someone can be recognised by their job, town or a unique event. More on this in Pseudonymisation or anonymisation.
4. Check the settings
In the consumer version of ChatGPT you can switch off, in the data controls settings, the use of your conversations to improve the models, and you can use a temporary chat. According to OpenAI, business plans do not use input for training by default. Note that the provider still processes and (temporarily) stores the data. Settings are therefore no substitute for anonymising.
5. Agree rules within your organisation
Regulators advise organisations to agree clear rules: may staff use AI chatbots and, if so, which data may and may not be entered? Put this in a short AI policy and make sure everyone knows it.
6. Share only what is necessary
Need help with one paragraph? Then don't paste the entire file. The less text, the lower the risk.
7. Check the answer
AI can make mistakes, including legal ones. Treat the answer as a draft and check facts, deadlines and legal references yourself, especially for objections or court documents.
The workflow in short: paste the letter into VerumVault → check the labels → safe version to ChatGPT → paste the answer back → restore the real names locally. The AI provider only ever sees [PERSON_1], [IBAN_1] and similar labels.
Lawyers have additional duties of confidentiality; read Anonymising documents as a lawyer. A practical step-by-step plan is in Anonymise a document in 3 steps.
Anonymise your document for free with VerumVault →Runs locally in your browser · no upload · no accountFrequently asked questions
Can I paste personal data into ChatGPT?
Usually it is not wise and often not permitted. You need a legal basis and may not share more data than necessary. Anonymise or pseudonymise the text first.
Is it a data breach if an employee pastes customer data into a chatbot?
According to the Dutch Data Protection Authority, yes, if it happens against the employer's rules. Reporting it to the supervisory authority is then often mandatory.
Is ChatGPT safe if I turn off training?
It helps, but the provider still processes and stores the data. Settings are no substitute for anonymising.
How do I get the real names back in the AI answer?
Paste the answer into 'Restore AI reply' in VerumVault. The labels are then replaced by the real data locally in your browser.