Is your business data safe when using ChatGPT?

We get asked this by every business that has found an employee using a consumer chat tool on a work laptop. The answer depends on which tool, which account, and what the employee is pasting into it.

The consumer product default

The consumer version of most chat tools is designed for an individual. When you paste text into the prompt, it is processed by the model. Whether that text is retained depends on the product's settings and the account's data controls. In a consumer account, the default is not the same as in a business tenant.

For an Australian business, the question is not "does OpenAI read my prompt?" in some abstract sense. The question is: "have I, as a business, consented to this personal information being processed by a third party under my privacy policy?" Most small businesses have not asked that question of their employees.

What employees actually do

In practice, employees use chat tools to draft emails, summarise meeting notes, rewrite marketing copy, and occasionally to "just check" a document. They do not usually paste customer data on purpose. They paste a paragraph from a contract, an extract from a report, or a list of names from a spreadsheet. They do not think of it as a data breach. They think of it as using a tool.

That is the gap. You do not need to ban the tool. You need a rule about what kinds of content are never pasted into a consumer chat window, and you need an alternative that lets them do the same work safely.

The safer alternative

If your employees are using a chat tool to do legitimate work, the right answer is to give them a business-controlled version. That means a deployment inside your Microsoft or Google tenant, with access controlled, prompts logged, and data processed in a region you choose. The work gets done. The data stays under your control.

The risk is not that employees use AI. The risk is that they use AI on personal accounts, with no log, no policy, and no alternative.

What to do this week

• Ask your team which chat tools they use, and on which accounts.
• Write a one-page rule: no customer data, no pricing, no contracts in consumer chat windows.
• Give them a business-controlled alternative for the work they actually do.
• Log what they ask, so you know what has been processed.