Guide
What can I put into ChatGPT at work?
The honest answer is that it depends on two things: what the information is, and which version of the tool you are using. Both take a couple of seconds to check once you know how.
First, which version are you in?
The same product name can cover very different arrangements. A free or personal account runs on consumer terms, and your conversations may be used to improve the model unless you turn that off. A business or enterprise licence bought by your employer usually comes with a contract that limits training and retention. An internal deployment runs inside your organisation's own systems.
The icon looks the same in all three. Before you paste anything that isn't public, check which account you are signed in with.
Then, which band is the information in?
The AI-Safe Desk course uses four bands. Most everyday work is green; the mistake is assuming everything is.
- Green: already public, or containing nothing about an identifiable person or a confidential business matter. Any tool is fine; you still check the answer.
- Amber: personal or commercially sensitive, but the AI could do the job without those details. Redact first: roles instead of names, placeholders instead of reference numbers, rounded figures where exact ones aren't needed.
- Red: health, safeguarding, criminal records, other special category data, privileged or restricted material. Never in a consumer tool. Only in a work tool your organisation has approved in writing for it.
- Black: passwords, keys, security settings, anything that opens a door. Never in any AI tool.
A quick example
You want help replying to a difficult client email. The client's name, company and account number add nothing to the task, so it is amber: replace them with 'the client' and 'their account', paste the rest, and put the details back when you write the real reply. The AI gets the shape of the problem and nothing identifying leaves your desk.
If your organisation has no AI policy
Treat anything beyond green as off limits until there is one, and ask whoever looks after data protection. If you are the person who needs to write it, the free policy starter on this site gives you a first draft to discuss.