GDPR and ChatGPT: What You May and May Not Do

One of the most common worries among Czech companies: “Are we even allowed to use ChatGPT when we work with customer data?”

The answer isn’t simple - it depends on what you send to the AI and under what conditions. This overview will help you decide in specific situations.

Important notice: This text is for information only and does not constitute legal advice. For your company’s specific situation, consult a lawyer or DPO.

The basic principle: ChatGPT is a data processor

When you send data to ChatGPT, OpenAI (or Microsoft for Copilot, Google for Gemini) becomes a processor of personal data within the meaning of GDPR. You remain the controller.

That means responsibility for whether the processing is lawful rests primarily with you.

What you may send

✅ Anonymised or aggregated data

If you remove all identifiers from the text (name, email, phone, address, the business ID of a sole trader), you can send the data freely.

Example: Instead of “Customer Jan Novák from Brno is complaining about…” → “The customer is complaining about…”

✅ Internal processes and documents without personal data

Contract templates without specific names, process documents, marketing copy, FAQs - all of this is fine.

✅ Your own data (about yourself or the company)

Company strategy, internal communication without third-party personal data, technical documentation.

✅ Publicly available information

Market analysis, competitor overviews, public documents.

What you may NOT send (without further safeguards)

❌ Customer names and contact details

Email, phone, address, a name + company combination = personal data.

❌ Sensitive personal data

Health information, financial situation, birth numbers, ID document numbers. These categories are subject to a stricter GDPR regime.

❌ Customer or lead databases

CRM exports, emails from customer mailboxes, accounting records with identifiers.

❌ Content of emails from customers

If a customer wrote to you, their email contains personal data. It cannot be sent to an AI without anonymisation.

Grey area: What depends on context

Contracts with specific names

It depends on the purpose. If you need to check a contract, anonymise the names and keep the structure. The legal content stays the same.

Meeting transcripts

A meeting transcript naming specific people contains personal data. Solution: either anonymise it, or use a tool with EU data residency and a signed DPA.

HR documents

CVs, employee evaluations, payroll information - strictly protected. Do not send to public ChatGPT.

How to do it correctly

Option 1: Anonymise before sending

The simplest solution. Create a procedure (or template) for how to anonymise data before entering it into the AI.

Option 2: ChatGPT Enterprise or Microsoft Copilot for M365

These versions offer:

A Data Processing Agreement (DPA)
Data is not used to train the model
The option of EU data residency (Copilot)

Price: from ~25 USD/user/month.

Option 3: A local AI model

Tools like Ollama with the Mistral or Llama model can be run on your own server. Data never leaves your infrastructure.

For companies with sensitive data (healthcare, legal services, HR), this is the safest route.

Practical checklist

Before every use of AI with company data, answer:

Does the text contain the name, email, phone or address of a specific person?
Is it sensitive personal data (health, finance, HR)?
Do you have a signed DPA with that AI provider?
Do the tool’s terms guarantee that data isn’t used for training?

If you answer “yes” to the first two questions and “no” to the third or fourth - anonymise the data first.

Conclusion

ChatGPT and similar tools can be used legally in a Czech company - but it takes a bit of discipline. Introducing a simple anonymisation routine can save you potentially very unpleasant problems with the Office for Personal Data Protection (ÚOOÚ).

The safest combination for companies: ChatGPT Enterprise or Copilot for M365 + internal rules for working with data.