Ask your team a simple question: who uses ChatGPT or a similar tool at work? The number will be higher than you expect. The salesperson writes proposals with it, the accountant summarizes statements, and the project manager pastes in minutes from a client meeting to pull out the tasks. Most of this use is helpful. The problem is that nobody has decided what may be entered, or from which account.
What is the real risk of using ChatGPT at work?
The biggest risk is sensitive data leaving the company for a service whose settings you do not control: contracts, customer data, negotiated prices and HR files. The next risk is an employee relying on a wrong answer without checking it, then sending a customer a figure or a legal clause the model made up.
You can deal with both. The first takes the right accounts and settings plus a clear list of what must never be entered. The second takes one simple rule: anything that comes out of the tool is a draft, and a person reviews it before it reaches anyone.
Is a personal ChatGPT account the same as a business account?
No, and the difference is about data. On personal accounts, conversations can be used to improve the models unless the user turns that off in settings, and the company can neither see nor control anything. Business plans from the major providers usually state that work data is not used for training by default, and they give an admin a console to manage users and data retention settings.
| Item | Employee's personal account | Company account or plan |
|---|---|---|
| Data used for training | Depends on the user's setting | Not used by default with most providers |
| Who owns the conversations | The employee | The company, and they stay when the employee leaves |
| User and permission management | None | From an admin console |
| Data processing terms | General consumer terms | Contractual business terms |
The details differ between providers and change over time. Read each tool's business data page before you approve it, and keep a copy of the terms you relied on.
What data should employees never paste into ChatGPT?
Even with a company account, no writing or summarizing task needs certain data. Write a short, clear list everyone can understand:
- National ID, passport, bank account and card numbers.
- Passwords, API keys and system login details.
- Health data, children's data and individual HR files.
- Full customer contracts with names, unless the tool is approved for that purpose.
- Source code or files that a client contract prohibits sharing.
Teach the team one simple habit: before pasting, remove the names, numbers and details the task does not need. Most tasks work just as well with "Client A" in place of the real company name.
How do you write an internal AI use policy?
Keep it to one page. Nobody reads a long policy, and the goal is for every employee to know what is allowed without having to ask each time.
- Approved toolsWhich tools, and from which account
- Prohibited dataA short list with no room for interpretation
- ReviewA person reviews everything that goes to a client
- DisclosureWhen we tell a client that text was prepared with a tool
- OwnerWho to ask about unclear cases
Review the policy every few months, because the tools and their settings change fast. Ask employees to tell you about new tools they try instead of trying them quietly.
What do data protection laws in Jordan and Saudi Arabia say?
Jordan issued its Personal Data Protection Law in 2023, and Saudi Arabia has its Personal Data Protection Law (PDPL). Both place obligations on anyone who collects and processes personal data, including rules on transferring data outside the country. Entering your customers' data into a tool that processes it abroad may fall under those rules. We are not a legal advisory firm, so if your business depends on sensitive data such as health or financial information, consult a lawyer before approving any tool.
How do you train your team to use AI safely?
A short session with examples from your own work does more than a long document. Show the team a request containing real customer data, then the same request with everything the task does not need removed, and show them the result is almost the same. Then show an answer that looked convincing but had a wrong figure or clause in it. Those two examples explain the policy better than any list. Repeat the session with every new hire.
When do you need an internal AI tool instead of public ones?
You need one when the same use repeats every day on sensitive data, such as summarizing client files or answering from internal documents. In that case the better fit is an internal tool that connects to the model through an API with settings you control, keeps the log in your own system, and gives each employee access only to what concerns them. One example is an assistant that answers from company documents running internally for staff.
We help companies choose and set up tools and build internal ones as part of our AI and automation solutions service. If you are just starting, read AI for your business: where to start. Tell us which tools your team uses today and we will help you write a policy that fits them.
Questions our partners ask
Does ChatGPT use what I type to train its models?
It depends on the account type. Personal accounts have a setting you can turn off to stop your chats being used to improve the models. For business plans and the API, OpenAI states that it does not use their data for training by default. Check each tool's current settings, because the details change.
Should I ban employees from using AI tools?
A total ban pushes many people to use them on their personal phones with no oversight. It works better to provide an approved tool on a company account and state clearly what may be entered into it.
Does removing names fully protect the data?
It lowers the risk a lot, but some details identify a person or company even without a name. Also remove numbers, addresses and distinctive details the task does not need.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
