Guides

Using ChatGPT at work under the GDPR: a practical checklist

By Dehumanize9 November 20263 min read

This is a practical guide, not legal advice. If your organisation has a privacy officer, their rules win. If it does not, this is the thinking most of them would apply.

The one idea to internalise

Under the GDPR, "personal data" is any information about an identifiable person. Not just names and ID numbers: an email address, a customer number, a licence plate, a job title in a small company, a description that narrows it down to one person. The moment you paste text containing such data into a third party AI service, you are processing it and usually transferring it to a processor. That is allowed, but only when the basics are in place: a lawful basis, a data processing agreement with the provider, data minimisation, and appropriate security.

Consumer accounts on AI tools typically do not come with a data processing agreement. Business and enterprise plans typically do, and exclude training by default. That difference matters more than any setting inside the product.

Pseudonymise first, always

The GDPR explicitly names pseudonymisation as a security measure (Article 32) and as a way to apply data protection by design (Article 25). Replacing jan.jansen@example.nl with [EMAIL_1] before the text leaves your computer does three things:

• The provider receives no directly identifying data for that field.
• If the text is retained, reviewed or breached, the damage is contained.
• You still get the help you came for, because the structure of the text is intact.

Pseudonymised data is still personal data as long as you hold the key that maps placeholders back to people. Keep that key on your own machine, which is how Scrub for AI works: the placeholder map never leaves the browser.

What usually needs more than pseudonymisation

Some categories are special under Article 9 and deserve extra caution or a decision by someone with authority: health data, religious or political views, trade union membership, sexual orientation, biometric and genetic data, and criminal records. Also tread carefully with data about children, with HR material such as performance reviews and sick leave, and with anything covered by professional secrecy (medical, legal, financial advice). For these, the right question is often not "how do I scrub it" but "should this go into a general purpose AI tool at all".

The checklist

1. Which account am I using? A personal consumer account for work data is the most common mistake. Use the plan your organisation has approved, with a data processing agreement in place.
2. Do I need the real values? For drafting, summarising, translating, classifying and debugging, almost never. Replace them.
3. Is there special category data? If yes, stop and ask.
4. Is training switched off and retention understood? Check the account settings once, and know roughly how long the provider keeps conversations.
5. Can I explain this to the person it is about? If pasting the text would feel awkward to justify to the customer or colleague involved, that is your answer.
6. Did I read the output before reusing it? Models sometimes insert details that were not in the input, including plausible but fictional personal data.

For the Netherlands specifically

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) has received data breach notifications about employees entering patient and customer data into AI chatbots, and has publicly warned organisations about it. The BSN (citizen service number) may only be processed where the law allows it, which in practice means it should never be in a prompt. Scrub for AI detects BSNs with the 11 check, as well as IBANs and Dutch phone formats.

What good looks like

A team that uses AI tools well under the GDPR does not ban them. It picks an approved tool, writes a one page rule set, and makes the safe path the easy path: a scrubber on every machine, a shared list of client names and codenames that must always be replaced, and a habit of pasting placeholders instead of people.

More: all guides · Scrub for AI · Copy for AI · Tables for AI