What data can you paste into ChatGPT? Rules for SMEs

Why this is the first rule

Most AI mistakes in an SME aren't technical. They are data in the wrong tool. Someone pastes a customer file into a free chatbot to draft an email quickly. What then happens to that data depends on the tool, the type of account and the settings. Often nobody in the company knows exactly.

The GDPR still applies. Putting personal data of customers or staff into an AI tool is processing. You need a legal basis and, for an external service, agreements with the provider.

A three-colour scheme

Green: public or general information, such as text from your website, a general question or an anonymous list. Allowed in the AI tools the company approves.

Orange: internal information without personal data, such as a procedure, a quote structure or internal figures. Only in a business AI environment whose terms the company knows, for example a business licence with agreements on data use.

Red: personal data, health and salary data, contracts, passwords and confidential customer information. Not in an AI tool, unless the company has explicitly set up a safe solution and agreements for it.

From rule to behaviour

A rule on paper changes little if nobody recognises red in practice. An invoice looks harmless until you notice a bank account number and a private address on it. So it pays to measure whether staff make the right choice in real situations, rather than asking whether they know the rule.

Record your rules and the measurement in your Article 4 register. That also shows the measures you took for your staff's AI literacy.

Checklist

List the AI tools in use, including free ones. Decide which are approved. Make the three colours concrete with examples from your own company. Measure per department whether it works, and repeat after a short lesson. General information, not legal advice.