ChatGPT in the workplace: what do GDPR, the AI Act and trade secrets say?
·
Updated on ·
By 
Aymeric Guyard · 5 min read
The real risk is not the tool, it's the version
Not all OpenAI offerings are legally equivalent, and most incidents stem from this fact.
| Version | Training on your data | Contractual framework | Professional use |
|---|---|---|---|
| ChatGPT free / Plus (individual account) | Yes by default (can be disabled in settings) | Consumer terms, no data processing agreement | To be avoided for any personal or confidential data |
| ChatGPT Team / Enterprise | No by default | Data Processing Agreement (DPA), confidentiality commitments, centralised administration | Acceptable with proper configuration and policy |
| OpenAI API | No by default | DPA, limited retention | For integrations developed by the organisation |
OpenAI also offers data residency options in Europe for its professional offerings and its API; verify this point in your contract, as well as the retention period for conversations and the sub-processors listed in the DPA.
GDPR: the four rules that apply to every prompt
- Minimisation (Article 5): a prompt containing a client's name, an HR file or medical history is personal data processing. The operational golden rule: anonymise or pseudonymise before submitting, and ban sensitive data (health, opinions, biometrics) from general-purpose tools.
- Legal basis and information (Articles 6 and 13): internal use generally relies on legitimate interest, provided the data subjects are informed (employees via the policy and HR privacy notice, clients if their data passes through the tool).
- Processing (Article 28): without a DPA, no personal data. This is the criterion that disqualifies free individual accounts for any use involving third parties.
- Transfers outside the EU (Chapter V): verify the transfer mechanism (standard contractual clauses, Data Privacy Framework certification) and the option for processing in Europe when available.
The French data protection authority (CNIL) has published recommendations on the development and use of AI systems and has made training data a priority for enforcement; the European Data Protection Board has, for its part, coordinated the work of authorities on ChatGPT.
AI Act: your two immediate obligations as a deployer
By using ChatGPT, your company is a deployer of an AI system (see the article on AI Act obligations for 2026). Two obligations are in force:
- AI literacy (Article 4): train employees who use it, at a level proportionate to their role. Proof of training is the first document requested in the event of an inspection or dispute.
- Transparency (Article 50): if ChatGPT feeds an agent exposed to your customers (chatbot, automated responses), individuals must know that they are interacting with an AI; generated content published to inform the public must be flagged, unless subject to human review with editorial responsibility.
HR uses (candidate screening, evaluation) will fall under the 'high-risk' regime on 2 December 2027: it is better to map them now.
Trade secrets: the risk everyone forgets
The protection of trade secrets (Articles L.151-1 et seq. of the Commercial Code, deriving from Directive 2016/943) is based on three conditions, including 'reasonable protective measures' taken by the company. Entering a formula, a strategic plan or source code into a public tool, without a contractual confidentiality framework, may be analysed as a disclosure incompatible with these measures: the information risks losing its legal protection, regardless of any technical incident. The confidentiality clauses signed with your own customers may also prohibit this type of sharing. The solution is organisational: classify information, and reserve confidential elements for tools under enterprise contract.
The AI usage charter in 8 points
- List of tools approved by the company (and versions: enterprise account, not personal account).
- Data prohibited in all circumstances: sensitive data, personal customer data outside tools under DPA, trade secrets, access codes.
- Anonymisation rule before any prompt containing internal information.
- Mandatory human review before any external use of generated content (customer, publication, contract): the company remains responsible for errors and hallucinations.
- Flagging of AI in content and agents exposed to the public (Article 50).
- Prohibition on using AI for individual decisions having a legal effect on a person without documented human validation.
- Mandatory initial training and annual reminders (Article 4 AI Act), logged.
- Incident reporting channel (data leak in a prompt, problematic output) linked to the data breach procedure.
Take action
Manage your compliance with Data Comply One: all-in-one software and outsourced DPO/CISO experts.
Discover the AI Act software →Test my AI compliance →Sources
- Regulation (EU) 2016/679 (GDPR), Articles 5, 6, 13, 28, 35 and Chapter V, EUR-Lex.
- Regulation (EU) 2024/1689 (AI Act), Articles 4, 26 and 50, EUR-Lex.
- Directive (EU) 2016/943 on trade secrets and Articles L.151-1 et seq. of the Commercial Code, Légifrance.
- The French data protection authority (CNIL), recommendations on the development of AI systems; EDPB, coordinated work on ChatGPT.