Expert guide

Is It Safe to Use ChatGPT with Company Data?

What happens to your spreadsheets and databases, what never to share, and how to get AI help without the risk

Free Cost Audit

Call us at +1 (385) 386-3860

Short answer: it can be, on the right plan with the right data. Business tiers (ChatGPT Team or Enterprise, the OpenAI API, Microsoft 365 Copilot for business) do not train on your data by default and provide admin controls; consumer accounts may. Never paste credentials, payment or ID numbers, health data or confidential client records into a general chat. For formulas, macros and queries, share the structure with invented sample rows, not real data. For AI on live business data, use a controlled setup such as DatabaseAI or a purpose-built AI workflow.

In almost every company we work with, someone has already pasted a customer list, a payroll sheet or an Access table into ChatGPT to get a formula or a summary. Usually nothing bad happens. Occasionally it creates a contractual or regulatory problem nobody notices until a client asks. This guide is not legal advice; it is the practical framework we use when adding AI to clients' Excel and Access systems.

What Actually Happens to Data You Paste In

Service typeUsed to train models?Admin controlsTypical use
Free / consumer chat accountsMay be, unless you opt out in settingsNonePersonal use
ChatGPT Team / EnterpriseNo, by defaultWorkspace admin, retention settings, SSO on EnterpriseCompany-wide assistant
OpenAI API (and other providers' APIs)No, by defaultKeys, usage limits, retention optionsAutomations and integrations
Microsoft 365 Copilot (business)NoMicrosoft 365 admin, existing file permissionsInside Excel, Word, Outlook, Teams
Locally run modelsNo, data stays on your hardwareFully yoursHighly sensitive data

Terms change. Check the current data usage policy for any tool before approving it, and record which plan your company uses.

Data Classes: What Can Go Where

DataConsumer chatBusiness AI planControlled integration only
Formulas, column names, made-up sample rowsYesYesYes
Aggregated figures (totals by region)AvoidYesYes
Customer names, emails, order historyNoIf policy allowsYes
Employee pay, HR recordsNoRarelyWith specific approval
Patient or health informationNoOnly under a signed agreement covering itPurpose-built, compliant setup
Card numbers, bank details, IDs, passwordsNoNoAvoid entirely

Getting Excel and Access Help Without Sharing Data

For formulas and macros: describe the structure

Instead of pasting 2,000 customer rows, write:

Sheet "Customers": A = CustomerID (text, e.g. C-1042), B = Name,
C = Region (North/South/East/West), D = Signup Date, E = Annual Value.
Sample rows (invented):
C-1001 | Example Co | North | 2024-03-11 | 12,400
C-1002 | Test Ltd    | West  | 2025-07-02 |  3,150
I need a formula in G2 that ...

For Access: share the schema, not the records

AI writes excellent Access SQL and VBA from a table list with field names and types. In Access, the Database Documenter (Database Tools → Database Documenter) produces a report you can trim to just names and types. Our guide on using ChatGPT to write Access SQL shows the prompt format.

For analysis: aggregate or anonymise first

  • Summarise to the level of the question (by month, region, product) before sharing.

  • Replace names with IDs and keep the mapping in your file only.

  • Remove free-text notes, which often contain personal details nobody remembers are there.

Risks People Overlook

  • Hidden sheets and columns

    Uploading a whole workbook shares hidden sheets, comments and external link paths too.

  • Copilot surfacing over-shared files

    Copilot respects permissions, so if a salary sheet is shared with everyone, Copilot can summarise it for anyone. Fix sharing before rollout.

  • API keys in VBA

    Keys written into a macro are readable by anyone who opens the VBA editor. Store them outside the file.

  • Client contracts

    Many client agreements restrict sending their data to sub-processors. AI services can count.

  • Wrong answers acted on

    Data leakage is one risk; acting on a confident but wrong AI summary is the more frequent one.

A One-Page AI Policy for Small Businesses

  • Approved tools: list them, with the plan (for example, 'ChatGPT Team workspace', 'Microsoft 365 Copilot').

  • Never share: passwords, keys, payment and bank details, ID numbers, health data, client data covered by confidentiality clauses.

  • Share only with approval: customer-level and employee-level data.

  • Always fine: structure, invented examples, public information.

  • Outputs: AI-written figures, formulas and code must be checked before they are used in reports or sent to clients.

  • Who to ask: name a person.

When You Want AI on Live Business Data

The safe pattern for regular, real-data use is an integration, not a chat window: a controlled service that holds the keys, sends only the fields needed, logs every request, and returns results to Excel, Access or SQL Server. For Access databases, DatabaseAI answers plain-English questions with read-only queries on your Windows machine. For broader processes, our AI workflow automation projects include data-minimisation rules and audit logs from day one. For the most sensitive data, see running a private local AI model on Access data.

FAQ

AI and company data FAQ

Plans, policies and practical safeguards

It depends on the plan and the data. Business plans such as ChatGPT Team and Enterprise, and API usage, do not use your data to train models by default and offer admin controls. Consumer accounts may use conversations for training unless you opt out. Even on a business plan, only share data your company policy allows, and avoid personal, health, payment and confidential client information unless your agreements explicitly cover it.

Microsoft 365 Copilot for business processes prompts and responses within the Microsoft 365 service boundary, respects existing file permissions, and does not use your organisational data to train the underlying models. That makes permissions hygiene important: Copilot can surface any file a user already has access to.

Passwords and API keys, payment card numbers, bank account details, government ID numbers, health information, and confidential client data covered by contracts, unless an approved, contracted AI system is specifically set up for that data. When in doubt, use made-up sample data with the same structure.

Describe the structure instead of sharing the content: column names, data types and a few invented rows. For formulas, macros and Power Query this is all the AI needs. For analysis, aggregate or anonymise first, for example totals by region rather than customer-level rows.

Yes, even a one-page one. Staff are already using AI tools. A short policy that lists approved tools, data that must never be shared, and who to ask reduces risk far more than a ban that people quietly ignore.