ChatGPT GDPR

You can, but not just any old way. GDPR doesn't ban using ChatGPT; what it requires is that any processing of personal data has a legal basis, that people are informed and that it's done with safeguards. In practice, the most prudent thing is not to put in data that identifies anyone and, if you need to, to use a business plan that includes a data processing agreement.

GDPR is the European regulation that protects people's data, and a name, an email address, a phone number or a purchase history already count as personal data. What usually confuses people is believing it's enough to switch off the option that lets your conversations be used to improve the model: it helps, but it doesn't make the use compliant on its own. The most useful trick is simple: change names to "Client A" and remove anything that would let someone recognise the person before pasting anything in. And if the AI is going to be part of a process in your business, review your privacy policy too.

Which client data can go into an AI and how I resolved it in my case I explain in "Is what I'm doing with artificial intelligence legal?". I tell it as what I am, someone who has had to ask these questions, not as a lawyer. If you handle sensitive data, such as health or financial data, consult a data protection specialist before putting it into any AI.