Is it safe to paste client data into ChatGPT?

Published 2026-07-29

Short answer: pasting identifiable client data into a consumer chatbot account is a disclosure to a third party, and most professional duties treat it that way. Pasting an abstracted version of the same problem usually is not. Almost every practical decision sits between those two sentences.

Here is how to get to an answer in five minutes rather than a week.

Question 1: which account is it?

This is the question people skip, and it changes the answer more than anything else.

Consumer plans and business plans are governed by different terms at every major provider. OpenAI’s policy states plainly that ChatGPT improves by training on your conversations unless you opt out, and that ChatGPT Business, Enterprise, Edu and the API are excluded from training by default. Anthropic changed its consumer terms on 28 August 2025 so that Free, Pro and Max conversations are used for model training unless the user opts out, with retention of up to five years; Team and Enterprise usage sits under separate commercial terms.

So “is it safe to paste this into ChatGPT” has no answer until you know whether “ChatGPT” means a personal account someone signed up for with their work email, or a company workspace with a signed agreement. In most organisations, both exist and nobody has said which one to use.

Question 2: does anyone have to consent?

If you hold information for someone else — clients, patients, students, employees — the duty is usually theirs to waive, not yours.

For lawyers, the ABA’s Formal Opinion 512 (29 July 2024) is the reference point. It applies the existing rules to generative AI and is specific on confidentiality: a lawyer must obtain the client’s informed consent before entering information relating to the representation into a self-learning tool, and boilerplate in an engagement letter does not amount to informed consent. It also expects lawyers to understand how a tool uses data — which means reading the terms, not assuming.

Health data has its own machinery. If you are a covered entity or business associate under HIPAA, you are looking at the de-identification standard in 45 CFR 164.514 or at a business associate agreement with the vendor. Consumer chatbot plans do not offer one. Education records sit under FERPA, whose de-identification test in 34 CFR 99.31(b)(1) asks whether there is no reasonable basis to believe the remaining information can identify a student.

Question 3: what happens to the text afterwards?

Assume durability. Retention policies are real, but they are not the only force acting on your data.

In the New York Times litigation against OpenAI, the court ordered preservation of consumer output logs — including conversations users had deleted. OpenAI’s obligation under that order ended on 26 September 2025 and it returned to standard retention, but logs captured while it was in force still exist, and in July 2026 the publishers moved for sanctions over how deletion continued during that period. None of this is unusual for a company in litigation. It simply means that “I deleted the chat” is a statement about your interface, not about the data.

The practical planning assumption: text you paste may exist somewhere for years, may be seen by a human reviewer, and may be produced in a legal process. Decide as though that is true.

Question 4: does the model actually need the identifying parts?

This is where most of the value is, and it takes ten seconds to check.

Look at what you were about to paste and ask what the answer depends on. A model summarising a support thread does not need the customer’s surname or card number — it needs the sequence of events. A model drafting a demand letter does not need the client’s address, it needs the facts and the tone. A model explaining a stack trace does not need the bearer token in the request header.

Almost always, the identifying values are the part the model would ignore anyway. That is why substitution works so well here: replace them with stable placeholders, get an answer about [NAME_1] and [COMPANY_2], and restore the real values in the reply afterwards. The reasoning survives intact because it never depended on the identity.

What “abstracted enough” means

Removing names is not the finish line. Two things still identify people after every identifier is gone:

Combination. A job title, a city and a date can be unique. Published re-identification work has repeatedly shown how few attributes are needed to single someone out in a population. HIPAA’s Safe Harbor method acknowledges this directly: even after all eighteen identifier types are removed, the covered entity must have no actual knowledge that the remaining information could identify someone.

Notoriety. If the matter has been in the trade press, the facts identify the party no matter what you call them. Ask whether someone who follows that sector would recognise the situation from the description. If yes, abstract further or do not use the tool.

A workable policy, in four lines

If you want something you can put in a team handbook this week:

1. Sanctioned tools first. If your organisation has an AI product with an agreement in place, use it and stop reading here.
2. If you are using a public chatbot, no client, patient, student or employee identifiers go into it — scrub them out first and restore afterwards.
3. Anything that has already been pasted and shouldn’t have been gets treated as disclosed: credentials rotated, incident logged.
4. Verify outputs. Opinion 512 says so for lawyers, and the courts have punished the alternative; it is good practice for everyone else too.

Where this tool fits

ScrubLocally exists for step 2. It highlights the identifiers in text you paste, replaces them with stable placeholders, and puts the real values back into the model’s answer — with the mapping held only in your browser tab, because the site has no server to hold it anywhere else. It does not answer questions 1 to 3 for you. Nothing can: those are judgements about your obligations, your account and your risk appetite.

What it does is make the right answer cheap enough that people actually choose it. A policy that requires ten minutes of manual editing per prompt is a policy that gets ignored by Wednesday.