AI & law clearly explained
ChatGPT in your business: How to keep data privacy on board.
Your team is already using ChatGPT – the only question is with which data. Here you will learn where the typical data privacy pitfalls lie in everyday work, which rules you can implement right away and free of charge, and when a data processing agreement and a business plan belong in the picture – honestly explained, without panic and without legal jargon.
* Transparency: this article contains affiliate links. If you take out a subscription through them, we receive a commission – the price does not change for you. This does not influence our assessment.
- Explained for beginners
- Rules you can apply right away
- No legal advice, an honest assessment
- As of September 2026
The basics
Why ChatGPT is a data privacy issue
Employees have long been using AI chats – often with private accounts, without anyone in the company knowing. There is even a name for this phenomenon: “shadow AI”. So the question is no longer whether ChatGPT is being used in your business, but how.
As soon as customer names, job applications or contract details end up in a prompt, a US provider is processing personal data. That is not a reason for a ban – but it is a call to set things up properly: personal data needs a legal basis, data subject rights such as access and erasure also apply when AI is used, and where a provider processes data on your behalf, a data processing agreement is usually part of the picture.
The good news: those who set rules instead of ignoring the topic get ChatGPT's productivity without unnecessary risk. That is exactly what this page helps with – step by step, from the free immediate setup to the question of when paid solutions are worth it.
The pitfalls
The six most common pitfalls in everyday work
Customer data in the prompt
Names, addresses, requests: whoever copies a customer email into the chat unchanged passes personal data on to an external provider. Anonymize first, then have it drafted – that takes ten seconds.
Private accounts for company work
Quickly drafting a company email in the evening with a private free account: convenient, but no one in the company knows which data ends up there. Separate business accounts make usage visible and manageable.
Training use never deactivated
In free and Plus accounts, inputs can be used to improve the models. This can be switched off in the settings under data controls – many people simply do not know that.
Job applications & HR topics in the chat
Summarizing CVs or drafting rejection letters: HR data in particular is especially sensitive. Without anonymization and clear internal rules, it does not belong in an AI chat.
Confidential contracts & figures uploaded
The draft contract or the revenue list as a file in the chat: a quick overview, but confidential content then sits with an external provider. Check first what the document really contains.
Privacy policy does not mention AI use
If AI is part of processes involving personal data, that usually belongs in the privacy policy. Many websites simply have not caught up here – a quiet classic among the omissions.
Most cases arise from not knowing better, not from bad intent – that is exactly what internal rules are for. How to bring AI into your workflows sensibly and cleanly overall is what we show under AI & Automation.
The most important question
What you can do for free – and when paid solutions belong in the picture
Rules cost nothing – only attention
The most effective measures do not cost a cent and can be implemented this very week:
- Deactivate training use in the settings (data controls)
- Rule of thumb for the team: no names, no customer data – anonymize first
- Keep private and business accounts separate
- Write a short internal policy – one page is enough to start with
- Create a basic privacy policy with the free eRecht24 privacy policy generator (affiliate link*)
Contracts and legal texts that grow with you
As soon as AI regularly works with real data, rules of thumb alone are no longer enough – then the following are typically part of the picture:
- A Business/Team plan with a data processing agreement as soon as real data is used regularly
- Automatically updated legal texts, e.g. with eRecht24 Premium (affiliate link*) – precisely because the legal situation around AI keeps moving
- In sensitive industries or when in doubt: a review by a lawyer
Frankly, the most expensive mistake is not the subscription but that one careless prompt – rules first, plans second. Note that eRecht24 is a German-language service aimed at websites operating under German law. Prices and features change constantly – the providers' current details are what counts (this page reflects September 2026).
The roadmap
Four steps to clean AI use.
-
Take stock
First clarify, without pointing fingers: who is already using which AI today – and for what? Only once you know what is actually happening can you set sensible rules instead of bans made in the dark.
-
Set the rules
Define what may go into the chat and what never may – and set up a simple approval path for new tools. One clear page that everyone knows beats a perfect document that no one reads.
-
Sort out accounts & contracts
Switch to business accounts, deactivate training use and sign a data processing agreement wherever personal data is processed regularly.
-
Update your documents
Update your privacy policy and internal documentation – for example with the generator or the automatically updated premium legal texts from eRecht24 (affiliate link*).
For perspective: we are web developers, not lawyers – but we have been building AI into client processes for years and know where things get stuck in practice. For the final legal check, a lawyer typically belongs in the picture when in doubt.
Frequently asked questions
Frequently asked questions about ChatGPT & data privacy.
Am I allowed to use ChatGPT in my business at all?
Yes – a blanket ban is usually not necessary. What matters is that you set rules: which data may go into the chat, which accounts are used and who approves new tools. If you sort that out, you get ChatGPT's productivity without taking unnecessary risks.
Does ChatGPT train on my inputs?
In free and Plus accounts, inputs can be used to improve the models – this can be deactivated in the settings under data controls. In the Team, Business and Enterprise variants, inputs are not used for training according to OpenAI. As of September 2026 – the provider's current details are what counts.
Which data must not go into the prompt?
As a rule of thumb, regardless of plan: what should not go on the internet does not belong unchecked in an AI chat either. This includes in particular customer names and addresses, job applications and HR topics, and confidential contracts and figures. If you want to process such content, anonymize it first or work with a business plan including a data processing agreement.
Do I need a data processing agreement for ChatGPT?
As soon as personal data is processed via a tool, a data processing agreement is usually part of the picture. The Team, Business and Enterprise variants of ChatGPT offer a Data Processing Addendum for this. Whether that is sufficient for your specific case is something to have checked by a lawyer when in doubt – this note does not replace legal advice.
Does my privacy policy have to mention AI use?
If AI is part of processes that handle personal data, that usually belongs in the privacy policy. Generators that are kept up to date help map such passages cleanly – precisely because the legal situation around AI keeps evolving. You can read more in our eRecht24 guide.
Further reading
These guides go well with this one.
eRecht24
Legal texts for your own website – what the free generator can do and when Premium makes sense.
ChatGPT
The best-known AI chat at a glance – what it can do, what it costs and how to get started.
Claude
The AI alternative from Anthropic – strengths, costs and an honest assessment for everyday business use.
All articles at a glance: AI Tools Guides
Your next step
You want to use AI sensibly in your business?
Then talk to us: we design and develop AI solutions that fit your workflows – from the first use case through integration with your systems to ongoing operation.
Prefer to talk directly? Call us: 0162 4071719
