Client dataand ChatGPT

Rule one: prompt as though it were public

Treat everything you type into a public AI tool as though it could end up outside your business. Names, addresses, financial details, health information and anything covered by your duty of confidentiality: leave it out. What does work is the same question with the details anonymised. “Rewrite this email to [client] about [project]” works just as well and leaks nothing.

Rule two: switch off training on your data

On the free tiers of many AI tools, your input is used by default to improve the models. You don’t want that for work material. Check your settings today: in ChatGPT it sits under Settings, Data Controls (switch off “Improve the model for everyone”); business plans such as Team and Enterprise don’t train on your data by default. With Claude the same principle applies: check your privacy settings and choose a business plan where you can.

Rule three: routine use calls for something on paper

If you use AI routinely in processes that client data passes through, a chatbot or a transcription tool for instance, then under the GDPR you’re responsible for what that tool does with the data. You cover that with a data processing agreement, ideally with an AI addendum setting out which tools may see which data. That’s how I built a fully GDPR-compliant AI chatbot for a client: the same convenience, without the loose ends.

The quick checklist

• No personal data or confidential information in public AI tools.
• Anonymise prompts: replace names and identifying details with placeholders.
• Switch off “train on my data”, or use a business plan.
• AI running routinely in your client processes? Put a data processing agreement in place, with an AI addendum.
• Teach your team these rules: that in itself is part of your AI literacy duty under the AI Act.

Unsure about your own setup? Email info@kimberleyvanruiven.nl and we’ll walk through it together.