Skip to content
AImori
EN
Free for Chrome
Menu

May employees enter customer data into ChatGPT?

In short: only if the company has clarified and allowed it – using a suitable business plan rather than a personal account. Without that, names, addresses, bank details and other customer data do not belong in an AI chat. This guide explains why and what companies can do. It is not legal advice.

Data protection law applies to AI too

The Swiss Federal Data Protection and Information Commissioner (FDPIC) states that the Data Protection Act is technology-neutral and applies directly to AI-supported processing. Entering customer data into an AI service means processing personal data – with all the duties that come with it.

For companies in Switzerland, these points matter most:

  • Processing by third parties (Art. 9 FADP): passing personal data to a provider requires a contract or a legal basis. The company remains responsible.
  • Disclosure abroad (Art. 16 and 17 FADP): the large AI services usually process data outside Switzerland. That is only allowed with adequate protection or suitable safeguards.
  • Sensitive personal data (Art. 5 let. c FADP): health data and similar information require particular care.
  • Professional and banking secrecy: professions such as doctors, lawyers or auditors are also bound by professional secrecy (Art. 321 Swiss Criminal Code), banks by banking secrecy (Art. 47 Banking Act).

In the EU, the GDPR has comparable rules: a data processing agreement (Art. 28) and specific conditions for transfers to third countries (Art. 44 et seq.).

Personal account or business plan?

The difference is significant. According to OpenAI, content from its services for individuals, such as ChatGPT with a personal account, may be used to train its models; you can turn this off in the settings. For its business offerings (ChatGPT Business or Team, Enterprise and the API), OpenAI says it does not train on your data by default.

If employees work with personal accounts, the company has neither a contract nor any control over what happens to the input.

What companies can do now

  1. Put the rules in writing: which AI services are allowed, with which accounts, and which data never goes in (e.g. customer data, bank details, social security numbers, passwords)?
  2. Business accounts instead of personal ones: choose a plan with a contract and check where data is processed.
  3. Train employees: short and concrete, with examples from their own work.
  4. Catch mistakes technically: most slips happen when pasting in a hurry. A browser extension like AImori checks input locally in the browser and warns before an IBAN, a social security number or a password is sent. It does not replace rules, but makes them work in everyday life. With rules per account it can be stricter in a personal AI account than in the company workspace, and the training traffic light on the icon shows whether an AI site uses input for training by default according to the provider.

Whether a particular text contains sensitive data is shown by the free test “Is this text safe to paste into ChatGPT?”, right in your browser.

AImori is free. Companies deploy the extension via Intune or Group Policy and set the rules centrally. How to get AImori · For companies

Read next: Shadow AI in small businesses · IBAN, social security numbers & co.: what never belongs in AI tools

Sources

Information as of 14 October 2026.

Free for Chrome