# Is pasting customer data into ChatGPT a GDPR breach?

It can be, depending on the data, the account and the terms. Under the GDPR, Regulation (EU) 2016/679, sending personal data to an AI provider is processing that needs a legal basis, transparency towards the people concerned and, where the provider acts on your behalf, a data-processing agreement. Transfers outside the EU need their own safeguards. On a business account with such an agreement and settings that prevent training on your data, use for a defined purpose can be lawful. Pasting customer e-mails into a personal account with consumer terms is harder to justify and may amount to an unauthorised disclosure, which the GDPR treats as a personal data breach; if it is likely to result in a risk to people, the controller must notify the supervisory authority within 72 hours under Article 33. Involve your data protection officer, record what was shared and with which service, and fix the cause with an approved tool. NetSenX shows from the Pro plan which hosts sent data to which AI services, not what the data was.

FAQ: [AI use and AI security](https://netsenx.com/en/faq/ai) · https://netsenx.com/en/faq/is-pasting-customer-data-into-chatgpt-a-gdpr-breach

## Read next

- https://netsenx.com/en/shadow-ai-detection
- https://netsenx.com/en/ai-transparency

## Related questions

- [Should employees caught using AI against the rules be fired?](https://netsenx.com/en/faq/should-employees-be-fired-for-using-ai-against-policy)
- [Employees bring their own AI tools to work. What is the risk?](https://netsenx.com/en/faq/what-is-the-risk-of-employees-bringing-their-own-ai)
- [Are AI browser extensions a security risk?](https://netsenx.com/en/faq/are-ai-browser-extensions-a-security-risk)
- [Does the EU AI Act require us to manage employees' AI use?](https://netsenx.com/en/faq/does-the-eu-ai-act-require-us-to-manage-employees-ai-use)
- [Does the AI Act apply to companies that only use AI tools?](https://netsenx.com/en/faq/does-the-ai-act-apply-if-we-only-use-ai-tools)