Blog

Is Using ChatGPT at Work GDPR Compliant? What to Check

· 5 min read · Nura Team

"Is ChatGPT GDPR compliant?" is one of the most common questions data protection teams get asked. It's also slightly the wrong question.

Under the GDPR, compliance isn't a property of a tool. It's a property of how your organization uses it. The same AI tool can be used in a perfectly lawful way by one company and in a way that creates real exposure for another. What decides it is which account people use, what data they put in, and whether you've done the groundwork.

This guide walks through the questions to answer. It applies to ChatGPT, but the same reasoning works for Claude, Gemini, Copilot and other AI tools.

This article is general information, not legal advice. Speak to your data protection officer or legal counsel about your specific situation.

You are responsible for what your staff share

When an employee pastes a customer's details into an AI tool to get work done, your organization is deciding why and how that personal data is processed. That generally makes you the controller for that processing, and the GDPR's obligations sit with you, not just with the AI provider.

That's the key point many organizations miss. A provider's privacy policy can't make your use lawful on its own. You still need a lawful basis, appropriate safeguards, and a record of what you're doing.

Question 1: Which account are people using?

This is the single biggest factor.

  • Personal or consumer accounts are governed by the terms between the provider and the individual. Your organization typically has no contract with the provider covering that data, little visibility of it, and no control over how long it's kept.
  • Business and enterprise plans are generally designed for organizational use. Providers commonly offer a data processing agreement (the contract Article 28 of the GDPR requires when a processor handles personal data on your behalf), administrative controls, and commitments about whether your data is used to train models.

Check your chosen provider's current business terms rather than relying on what was true last year. These terms change. But as a rule, if staff are processing personal data in AI tools on personal accounts, you have a gap.

Question 2: Do you have a lawful basis and a clear purpose?

Every processing activity needs a lawful basis under Article 6, and the purpose should be specific and documented. "Staff use AI to draft customer replies" is a purpose you can assess. "Staff use AI for whatever they like" isn't.

If the data includes special category data (health, ethnicity, religious beliefs, biometric data and so on), Article 9 sets a much higher bar. For most organizations, the practical answer is that this data shouldn't go into general-purpose AI tools at all.

Question 3: Are you sharing more than you need to?

The GDPR's data minimisation principle (Article 5) says personal data should be limited to what's necessary for the purpose.

This is where most everyday AI use falls down. Someone asking for help with the tone of a reply to a complaint doesn't need to include the customer's full name, email, phone number and account number. The AI gives the same help with "[Customer]" in their place.

Minimisation is also the easiest win. Masking personal details before a prompt is sent removes much of the risk while keeping almost all of the usefulness.

Question 4: Where does the data go?

Many AI providers process data outside the European Economic Area. Transfers of personal data to third countries need a valid mechanism under Chapter V of the GDPR, such as an adequacy decision or standard contractual clauses. Check where your provider processes data and what transfer mechanism its terms rely on.

Question 5: Have you assessed the risk?

Where processing is likely to result in a high risk to individuals, Article 35 requires a data protection impact assessment (DPIA). Rolling out AI tools across an organization, especially where customer or employee data may be involved, is exactly the kind of change that warrants at least a screening assessment.

A DPIA doesn't have to be a huge exercise. It should describe what data may be shared, with which tools, the risks, and the measures you're taking to reduce them.

Question 6: What happens when something goes wrong?

If someone pastes personal data into an unapproved tool, that may amount to an unauthorised disclosure, which the GDPR treats as a personal data breach. Breaches that are likely to result in a risk to individuals must generally be reported to your supervisory authority within 72 hours of you becoming aware of them (Article 33).

You can only meet that deadline if you know it happened. Without visibility of what's being sent to AI tools, most organizations find out late, if at all.

Question 7: Can you show your work?

The GDPR's accountability principle means you need to be able to demonstrate compliance, not just claim it. For AI use, that means being able to show:

  • Which tools are approved, and on which plans
  • Your policy on what data may and may not be shared
  • The technical measures in place (Article 32 requires security appropriate to the risk)
  • A record of incidents and how you handled them

A practical compliance checklist

  • Approved AI tools are on business plans with a data processing agreement in place.
  • Personal accounts are not used for work involving personal data.
  • There's a documented purpose and lawful basis for AI use involving personal data.
  • Special category data is kept out of general-purpose AI tools.
  • Personal details are masked or removed before prompts are sent wherever possible.
  • International transfers have a valid mechanism.
  • A DPIA or risk screening has been completed.
  • You can detect and log when personal data is sent to AI tools.

Not just the GDPR

The same principles appear in data protection laws around the world, including the UK GDPR, Brazil's LGPD, South Africa's POPIA and Saudi Arabia's PDPL. The details differ, particularly on international transfers, but the core questions are the same: what data, what purpose, what safeguards, and can you prove it?

Where Nura helps

Nura covers the parts of this checklist that policy alone can't. It inspects every prompt in the browser before it reaches ChatGPT, Claude, Gemini and other AI tools, and can mask personal data automatically so staff still get their answer without the real details leaving your organization. It can block the data you never want shared, and it keeps a log of every decision, giving you the visibility to spot incidents quickly and the records to demonstrate accountability.