John SerraIt depends on which account you use, which settings are on, and what the data is. On a personal ChatGPT account, OpenAI says it may use your conversations to train its models unless you turn that off. On its business products and the API, OpenAI says it doesn't train on your data by default and offers contracts that cover how it handles it. So routine, non-sensitive work is usually fine on an approved account with training turned off. Passwords and API keys don't belong in an analysis prompt on any plan. Customer personal data, anything your contracts restrict, and regulated records need an approved service, permission to share the data, and whatever agreements and controls apply, or they shouldn't be uploaded at all. This isn't legal advice, and the details below were checked against OpenAI's own pages on October 7, 2026. Plans and settings change, so recheck before you rely on them.
Four Questions, Not One
"Is it safe?" is really four separate questions:
- Training: does the provider use what you enter to train its models?
- Retention and access: how long does it keep what you enter, and who can see it?
- Permission: do your customer contracts, NDAs, or privacy notices allow you to send this data to an outside service at all?
- Regulation: does a law or regulation that applies to you require a specific agreement or controls?
A training setting answers only the first question. It says nothing about retention or access, and it doesn't answer the third or fourth. A vendor's security certification doesn't override a contract that says you can't share a client's files with a third party.
Personal Accounts vs. Business Plans
OpenAI separates its products for individuals from its business offerings, and the terms differ. This table summarizes what OpenAI's enterprise privacy page and consumer data handling page describe. Details vary by product and configuration, so treat it as a map, not a guarantee.
| Personal accounts (Free, Go, Plus, Pro) | Business products (Business, Enterprise, Edu) and API | |
|---|---|---|
| Used to train models? | May be, unless you turn off "Improve the model for everyone" | Not by default, unless your organization opts in |
| Retention | Saved chats stay until you delete them. Deleted chats are scheduled for permanent deletion within 30 days, with exceptions for security and legal obligations and for data already de-identified | Varies by product. OpenAI's enterprise privacy page says workspace admins can control retention, while its user lifecycle guidance says Business workspaces keep chats and files indefinitely. Confirm which applies to your workspace. API retention depends on the endpoint and feature, and zero data retention needs approval and has limits |
| Who can access it? | You, plus limited OpenAI personnel and service providers for support, security and abuse investigations, and legal purposes. If model improvement is on, content may also be used for training | Depends on how your organization manages the account: its plan, permissions, and configuration. Limited OpenAI access for the same kinds of purposes still applies |
| Data processing agreement | No | Available for ChatGPT Business, Enterprise, and the API |
| HIPAA business associate agreement | No | Not for ChatGPT Business. OpenAI describes BAA routes for eligible API organizations and for sales-managed Enterprise and Edu accounts, but only specific products and configurations are HIPAA-eligible, and API use requires the retention configuration OpenAI specifies for your BAA |
Two plain-English terms from that table:
- A data processing agreement (DPA) is a contract about how a vendor handles personal data on your behalf. The UK Information Commissioner's Office explains this in its guidance on controller and processor contracts, which matters for laws like GDPR.
- A business associate agreement (BAA) is the contract HIPAA requires when a vendor handles protected health information for a covered entity or its business associate. A signed BAA isn't enough on its own. The HHS cloud computing guidance also expects a risk analysis and the other HIPAA safeguards. If you don't deal in health data, you can skip it.
Administrator powers are the part most likely to be misread. OpenAI's pages describe admin access, sharing, and analytics controls for business accounts, but they don't promise the same capabilities for every workspace. Its managed-account notice says what an administrator can access depends on the organization's configuration and applicable law, and its Business help page says private chats aren't automatically visible to other members and that data export isn't available in Business. Before you rely on an admin control, confirm it in your own workspace.
OpenAI's business pages also say that its security controls have been audited under SOC 2 Type 2 and that data is encrypted at rest and in transit. That describes how well the data is protected. It doesn't give you permission to share data your contracts restrict.
Turn Off Training on a Personal Account
If you use a personal account for work, change this first. On the web:
- Open your account menu and choose Settings.
- Choose Data controls.
- Select Improve the model for everyone, turn it off, and choose Done.
On the mobile app, open the sidebar, select your profile icon to reach Settings, then Data controls. The setting follows your account across devices when you're signed in. OpenAI's data controls help article has the current steps.
Four details matter:
- Turning it off doesn't delete anything. Your chats stay in your history.
- It applies to new conversations, not ones you've already had.
- If you click thumbs up or thumbs down on a response, OpenAI says the entire conversation attached to that feedback may be used to train its models, even with training off.
- A temporary chat doesn't appear in your history, isn't used to train models while it stays temporary, and may be retained for up to 30 days for safety purposes.
Files you save to your Library are separate from chats. Deleting a chat doesn't delete them, so delete the files too if you want them gone. Check the memory setting as well, since it's a different control from training.
These menus and setting names change often, which is why the article is dated. If a step doesn't match your screen, search OpenAI's help center for "data controls."
A Quick Check Before You Upload
Check every row that applies, not just the first one. Upload only if every applicable requirement is met. A business plan, a signed agreement, or redaction can satisfy one row without clearing the others: a customer list can be personal data and also covered by an NDA.
| If the data is… | Then |
|---|---|
| Credentials, passwords, API keys, or full account and card numbers | Don't paste it into an AI tool on any plan. |
| Health information about identifiable people | If HIPAA applies to you, you need a BAA that covers the specific service and configuration, plus the other HIPAA obligations. If it doesn't apply, keeping health data out of AI tools is still a sensible team rule, but it's your policy choice. |
| Customer or employee personal data | Redact it. If you really need the identifiers in the analysis, use an approved business service with a DPA, and check your privacy notice allows it. |
| Confidential material covered by a client contract or NDA | Check what the contract allows first. If it's unclear, ask the client or don't upload it. |
| Internal business numbers, even with names removed | Still check the tool is approved and your contracts allow it. Removing names doesn't make figures non-confidential or impossible to trace back. Use made-up numbers when you only need to show a formula. |
| Public or non-sensitive material | Any approved account. Training off is still a sensible default. |
One Practical Risk
One practical risk is an employee pasting something they shouldn't into a tool nobody approved. Bloomberg reported in May 2023 that Samsung restricted staff use of generative AI after discovering that sensitive code had been uploaded to ChatGPT. One incident doesn't show how often this happens, but you don't need to be a large company for the same thing to occur: a customer list, a payroll sheet, or a contract pasted into a personal account to "just get a summary."
If several people use AI at work, don't let them share one login. Individual accounts, or a managed business workspace where an admin can control access, give you something to point to when someone leaves or a question comes up. Check which admin controls your plan and configuration actually provide.
Redact First
AI models rarely need your real names or account numbers to help with the math. Before you paste in business data, strip what identifies people and replace it with labels.
Instead of: "Acme Corp (client ID 4912) owes $45,200, 60 days past due, on account ending 8819."
Use: "Client A owes $45,200, 60 days past due."
That's pseudonymization: replacing names with aliases. It helps, but it isn't anonymization. Distinctive amounts, dates, or context can still point to a real customer. The ICO's pseudonymisation guidance explains that pseudonymised information can still be personal data for anyone able to reconnect it to a person, and that whether it is personal data in someone else's hands depends on whether they can identify the individual. Its anonymisation guidance adds that whether data counts as anonymous depends on whether identifying someone is reasonably likely, not on whether you changed the names. That guidance is UK-specific, and other laws differ, but the practical warning applies anywhere.
To lower the risk further, take out account and routing numbers, round dates to months, and, if the exercise only needs ratios, multiply every amount by the same factor. Rescaling keeps the ratios, but it doesn't guarantee anonymity: if someone knows one original value, they can work out the factor. Don't rescale if you need real thresholds. When you only need to demonstrate a formula, made-up figures are safer than any disguised real ones. Keep the original file in your own spreadsheet, and let the AI see only the stripped copy. A cash flow tracker you build yourself is a good example of analysis that never needs to leave your own sheet.
Files and Spreadsheets Carry More Than You See
Pasting text is easy to inspect. A spreadsheet or document you upload can carry more: other tabs, hidden columns and rows, cell comments, tracked changes, and file properties that include author names. Before you upload a file, make a copy and delete everything the question doesn't need, or paste only the cells you want analyzed. If the work involves formulas, share the formula structure with made-up numbers rather than the real sheet.
Three Rules for a Small Team
- No credentials in any AI tool, and no raw customer identifiers on a personal account. Passwords, API keys, bank logins, and card numbers stay out on every plan. Customer names tied to financial details, Social Security numbers, and health information stay off personal accounts.
- Match the account to your obligations. Check your customer contracts and NDAs first. If they limit sharing with outside services, or if a regulation applies, use an approved business service or the API under the right agreement and settings, or don't upload it. A privacy setting doesn't override a contract.
- Treat the output as a draft. Check any AI-generated number or conclusion before you act on it.
Write the three rules down and put them where your team will see them. A follow-up article covers the restricted-data list in more detail.
Frequently Asked Questions
Does turning off training make ChatGPT safe for confidential data?
It removes one risk, the use of your new conversations for model training. It doesn't change retention, who may see the data, or what your contracts allow.
Is a business plan automatically compliant?
No. A business plan gives you contractual protections and admin controls, and the controls available depend on the plan and how it's configured. Whether you're allowed to send a particular data set still depends on your own obligations.
What if an employee already pasted something sensitive?
Tell whoever is responsible for security or privacy, or the business owner, right away. If a password or API key was pasted, revoke and replace it immediately; OpenAI's API key safety guidance advises rotating any key you suspect was exposed. If the data was covered by a customer contract, tell the person who owns that relationship. Then deal with the chat, any saved files, and other copies through your incident process, and don't delete things blindly if you may need them as a record. Deleting a chat doesn't undo the disclosure, since deleted chats are only scheduled for permanent deletion, and legal or security exceptions can apply.
Where can I check the current terms?
Start with OpenAI's enterprise privacy page, its API data controls documentation, and its data controls help article, since the specifics change. For HIPAA, see OpenAI's pages on business associate agreements and HIPAA-eligible products.