Can I use ChatGPT with customer data?

This is one of the most frequent doubts of companies starting to use AI: can I paste a customer's email? A contact list? A patient record? There is no single answer, and this article is not a substitute for legal advice, but there are simple principles that help you decide well.

What counts as personal data

Any information that identifies a person, directly or indirectly: name, email, phone number, address, tax number, photograph, and also combinations that make it possible to work out who it is. Health data, children's data and other sensitive data call for even more care.

First principle: many tasks do not need it

Almost everything done with AI in an SME works without personal data. Writing a draft email, summarising a text, suggesting headlines, structuring a proposal: all of this can be done with generic information. Before pasting, ask: is the name needed? The contact? If not, take it out.

Second principle: anonymise before pasting

When the text comes from a customer, replace whatever identifies them: "customer A", "a company in sector X", "the person". You keep the context, without the identity. It is a simple habit that avoids most problems.

Third principle: know what the tool does with what you give it

Not all tools treat data the same way. In some, what you type may be used to improve the model unless you change a setting; in others, business plans have different rules from personal plans. Read the privacy settings and the terms of the plan you use, and choose the plan according to what you will do with it. If you are not sure, assume that what you paste may be stored.

Fourth principle: have a written rule

A one-page rule for the team avoids decisions made at random. A good rule says:

• which tools can be used, and with which account (the company's, not a personal one);
• what is never pasted: health data, identity documents, customers' financial information;
• what is anonymised first;
• who decides in case of doubt.

Fifth principle: transparency

If you use AI in processes involving personal data, the privacy policy should reflect it. People who share their data have the right to know how it is handled. If you are considering tools that process data on the company's behalf, also check whether there is a data processing agreement with the supplier.

When it is worth asking for help

If your company handles health data, minors' data or a large volume of customer data, talk to someone who understands data protection before automating. It is cheaper than correcting afterwards.

In process automation, each automation is tied to a concrete task and tested before going ahead, and one of the first questions is always what data passes through. To see where AI already helps without big risks, read AI Tools for SMEs.

A first step for today

Ask the team which AI tools they already use and for what. Without blaming: just to know. Often you discover that several are already in use, on personal accounts and without rules. That list is the base for everything else: the internal rule, the choice of tools and the training that is needed.

In short

• Many tasks work without personal data.
• Anonymise before pasting and check what the tool does with what you give it.
• Write a one-page rule for the team.

Quick questions

Can I paste a customer's email?

Only if necessary, and after removing what identifies the person. If the text stops making sense without the name, ask yourself whether the task is for an AI.

Does the business version solve everything?

It helps, because it usually has different rules about data use, but it does not remove the need for good practice: anonymising, limiting what is shared and having an internal rule.

What if a team member has already used customer data?

It is not about blame, it is about correcting. Understand what was shared, see what the tool lets you delete and, if sensitive data is involved, talk to someone who understands data protection.