"Can we put customer data into ChatGPT?" It is the question we hear most often from SMEs, and the honest answer is: it depends on how. Typing a customer's name, a candidate's CV or an employee's email into a generative AI tool is processing of personal data in every sense, and your company is the controller. The GDPR (Regulation EU 2016/679) does not forbid it, but subjects it to the same rules as any other processing entrusted to an external supplier. The internal AI use policy says who may do what; this article explains when that "what" is lawful.

The first mistake: thinking the problem belongs to the provider

The provider of the tool can be a processor (Art. 28 GDPR) or an independent controller, and the whole difference lies here. If it processes your content only to deliver the service to you, on your documented instructions and under an Art. 28 contract, it is a processor: you remain the controller and the chain is in order. If instead it uses your content for its own purposes, such as training its models, for that part it is an independent controller, and you are disclosing personal data to it without a legal basis.

This dividing line almost always coincides with the type of plan. With a free or personal account there is no contract at all between your company and the provider, and the content may be used to train the models: in OpenAI's documentation the "Improve the model for everyone" setting is on by default on the Free, Plus and Pro plans, and turning it off is not retroactive. The business plans and APIs of the main providers, by contrast, state that they do not use content for training and offer a data processing agreement: Microsoft, for example, states that prompts, responses and data accessed through Microsoft Graph in Copilot are not used to train the foundation models and, for EU users, stay within the EU Data Boundary. These are the providers' statements: they must be verified in the contract, not on the marketing page.

The seven checks before entering personal data

  1. Business plan and Art. 28 contract. The agreement must contain what Art. 28(3) requires: the controller's instructions, confidentiality, security measures, the regime for sub-processors, assistance with data subjects' rights, deletion or return of the data at the end of the service, the right to audit. Without this contract, personal data does not go in.
  2. Training excluded. Check in the contract (not in the settings, which an employee can change) that content is not used to train or improve the models, and who the sub-processors are: many assistants built into business software rely on third-party models.
  3. A legal basis for that use. The tool is a means; the processing you perform with it needs its own basis (Art. 6): the contract with the customer, a legitimate interest documented with the three-step test (legitimate interest, necessity, balancing) recalled by the EDPB in Opinion 28/2024, rarely consent. If you reuse data collected for another purpose, the compatibility assessment of Art. 6(4) is required.
  4. Non-EU transfers. Find out where the data is processed. For participating US providers the Data Privacy Framework adequacy decision (10 July 2023) applies, upheld by the EU General Court on 3 September 2025 (Case T-553/23, Latombe) and now before the Court of Justice in appeal C-703/25 P; otherwise standard contractual clauses are needed. If the provider offers EU data residency, choose it and record it.
  5. Privacy notice and record of processing. The notice (Arts. 13 and 14) must mention the new category of recipients and, if it changes, the purpose; the record of processing activities (Art. 30) must include the new processor and the tool. The record is due even below 250 employees when the processing is not occasional, which is almost always the case here.
  6. DPIA in risky cases. Art. 35 requires it where the risk is high, and the Garante's list (decision no. 467 of 11 October 2018) includes processing with innovative technologies such as AI systems when at least one other WP248 criterion applies: evaluation of individuals, large-scale data, vulnerable data subjects, including employees. Summarising an email, no; evaluating employees or analysing health data, yes.
  7. Security, retention, rights. Art. 32: who can access the history, how long it is kept, whether a conversation can be deleted at a data subject's request (Arts. 15-17). And the most effective rule of all, minimisation: before pasting, strip out what is not needed. A contract to be reviewed does not need the customer's name.

And the model? What the EDPB asks of those who use it

The EDPB's Opinion 28/2024 (17 December 2024) clarifies three things that also concern those who merely use a model developed by others. First: a model trained with personal data is not automatically anonymous; anonymity must be demonstrated case by case. Second: legitimate interest can be the legal basis both for developing and for using the model, but only by passing the three-step test. Third, and this is the point for SMEs: if the model was developed by processing data unlawfully, the authority will consider whether the user carried out an appropriate assessment, proportionate to the risk, to ascertain that this was not the case. In practice: ask the provider for documentation on the sources of training data and on any decisions concerning it, and keep the assessment in your compliance file.

What the three Italian cases teach

OpenAI. On 20 December 2024 the Garante closed its investigation into ChatGPT with a €15 million fine and a six-month information campaign, finding no legal basis for training, transparency violations, failure to notify a March 2023 data breach and no age verification. In March 2026 the Court of Rome annulled the fine, but only for lack of competence: since 15 February 2024 OpenAI has had its main establishment in Ireland, and for cross-border processing the Irish lead authority decides (one-stop shop, Arts. 56 and 60 GDPR). Not a word on the merits. The lesson is twofold: questions about the provider move to Dublin, but the processing for which you are the controller stays with the Garante.

DeepSeek. On 30 January 2025 the Garante urgently ordered a restriction of processing of Italian users' data, after the Chinese companies had declared that they did not operate in Italy and were not subject to European law. A tool with no EU establishment, no transfer safeguards and no contract cannot appear among the approved tools of a company policy.

Replika. In 2025 the Garante fined Luka Inc. €5 million: no legal basis identified for the processing, an inadequate privacy notice, no age verification. In parallel it opened a separate investigation into the entire lifecycle of the underlying generative model. The authority's questions are the same as the seven checks.

The GDPR does not work alone. Since 2 February 2025, Article 4 of the AI Act (Regulation EU 2024/1689) requires an adequate level of AI literacy in those who use AI: whoever pastes data into a tool must know the seven checks, and the training must be documented. From 2 August 2026, Article 50 requires chatbots and generated content to be disclosed externally. On the GDPR side, the Digital Omnibus proposal on data presented by the Commission in November 2025, which would make legitimate interest for AI development explicit, is still under negotiation between Council and Parliament as of mid-September 2026: today the rules described here apply.

Where to start

The starting point is not the contract with the provider, but an honest snapshot of which tools are already running in the company, with which accounts and which data. In most SMEs the result is surprising: personal accounts, free plans, built-in assistants never inventoried. An independent gap assessment cross-checks this snapshot against the seven checks, identifies the processing to regularise immediately and produces the documentation (contracts, record, DPIA, model assessment) that stands up to a request from the Garante. It is the fastest way to turn "it depends on how" into "here is how".