Employees using ChatGPT with company data: AI usage policy and LGPD

In many small businesses, artificial intelligence arrived without anyone deciding on it. The support agent pastes a customer complaint into ChatGPT to write a polite reply. Finance uploads the list of overdue customers to "tidy it up". HR asks for help summarizing résumés. All of it on personal accounts, on a phone or in a browser, without management knowing. The market calls this shadow AI: AI used outside IT and outside company rules.

This article shows why banning it does not work, what must never go into an AI chat, the real difference between a personal account, a business plan and the API (checked on the official OpenAI, Google and Anthropic pages on 09/30/2026), a one-page AI usage policy template to copy and adapt, and what Brazil’s data protection law (LGPD), its data protection authority (ANPD) and AI bill PL 2338/2023 already signal. This text is informational and is not legal advice: for decisions about your company, talk to your lawyer or data protection officer (DPO).

Why banning it does not work

The most common reaction is an email: "using ChatGPT is forbidden". The problem is that the tool solves a real need (writing, summarizing, translating, building a spreadsheet formula) and is one tap away on the employee’s personal phone. A ban with no alternative does not remove the use, it only removes visibility. The company keeps the same risk and loses all information about it.

What works is the opposite: provide the right tool, with a company account and known settings, and write short rules on what is and is not allowed. When there is an official option as practical as the personal one, most people prefer the official one, because nobody wants to be the person responsible for a leak.

A ban still makes sense for specific cases: health data, children’s data, information under contractual confidentiality. But the ban becomes one line of the policy, not the whole policy.

What must never go into an AI chat

The practical rule: if you would not email it to a stranger, do not paste it into a personal AI chat. In any tool, even a business one, take extra care with:

• Personal data of customers, employees or suppliers: name, CPF (the Brazilian taxpayer ID), phone, email, address, purchase history, salary, performance review. The LGPD defines personal data as any information related to an identified or identifiable natural person (art. 5, I).
• Sensitive personal data: health, racial or ethnic origin, religion, political opinion, union membership, sex life, genetic or biometric data (art. 5, II). Medical certificates, reports and test results never go into a personal AI chat.
• Trade secrets: cost tables, margins, bid proposals, customer contracts, strategy, customer lists, proprietary source code.
• Credentials: passwords, API tokens, access keys, database connection details. A screenshot with a visible password counts.
• Third-party documents under confidentiality: material received under an NDA, data a customer entrusted to your company for a specific service.

In most tasks you can remove the data and keep the usefulness. Instead of "reply to customer João Silva, CPF such-and-such, who complained about invoice 4521", write "reply to a customer who complained about an invoice with the wrong due date, in a friendly tone". The AI does not need to know who the customer is to write a good reply.

Personal account, business plan or API: what changes for your data

The same brand offers products with very different data rules. The summary below was checked on the vendors’ official pages on 09/30/2026. Terms change, so reread them before signing up.

Details by vendor, as stated on each official page:

• OpenAI (ChatGPT): on Free, Plus and Pro accounts, OpenAI may use conversations to train models if "Improve the model for everyone" is on; you can turn it off under Settings, Data controls. Temporary chats are not used for training and are deleted after 30 days. For ChatGPT Business, Enterprise, Edu and the API, OpenAI states it does not use data for training by default. On the API, data sent has not been used to train models since March 1, 2023, and abuse monitoring logs are kept for up to 30 days; approved customers can get Zero Data Retention. OpenAI offers a data processing addendum (DPA) for Business, Enterprise and the API.
• Google (Gemini): on personal Gemini accounts, some conversations are read by human reviewers, reviewed conversations are kept for up to 3 years, and Google itself asks users not to enter confidential information. Default activity history is deleted after 18 months. On Google Workspace work accounts, Google states content is not human reviewed or used to train models outside your domain without permission. On the Gemini API, watch out: on the free tier Google may use content to improve products, with human review; on the paid tier it does not (terms updated 04/28/2026).
• Anthropic (Claude): on Free, Pro and Max plans, conversations are used to train models when the improvement setting is on, with retention of up to 5 years; with it off, retention is 30 days. Claude for Work (Team and Enterprise), Claude for Education, Claude for Government and the API fall under commercial terms, and Anthropic states it does not use inputs and outputs from these products for training by default.

Two points few people check. First, the rating button (thumbs up or down) may send the whole conversation to the vendor for improvement, even on a business plan; the admin can turn it off. Second, these vendors’ servers are outside Brazil. The list of data residency regions for the OpenAI API, for example, does not include Brazil. That is an international transfer of personal data, which the LGPD only allows under the cases in art. 33, regulated by ANPD Resolution CD/ANPD No. 19/2024 (which covers, among other mechanisms, standard contractual clauses). When personal data is involved, the vendor contract needs to be read by someone who knows the subject.

One-page AI usage policy template

A policy nobody reads protects nothing. The template below fits on one page and uses sentences employees understand. Replace the names in brackets and adjust it to your industry.

Item 9 is the most important. The LGPD requires the controller to notify the ANPD and the data subjects of security incidents that may cause relevant risk or harm (art. 48), and Resolution CD/ANPD No. 15/2024 set a deadline of 3 business days from awareness of the incident. If employees are afraid to report, the company finds out too late. For the rest of your security routine, see our cybersecurity checklist for small businesses.

What the LGPD, the ANPD and PL 2338/2023 already signal

There is currently no specific Brazilian AI law in force. But the LGPD (Law 13,709/2018) already applies to any personal data that passes through an AI tool, just as it applies to a spreadsheet or an email. In practice, four points matter:

• Security (art. 46): whoever processes personal data must adopt technical and administrative measures to protect it from unauthorized access and improper processing. An AI usage policy and controlled business accounts are exactly that kind of administrative measure.
• Liability (art. 42): a controller or processor that causes harm to a data subject in violation of data protection law must repair it. For the customer whose data was exposed, the one processing the data was your company, not an individual employee.
• International transfer (art. 33): only allowed under the cases in the law, which include the standard clauses in Resolution CD/ANPD No. 19/2024.
• Penalties (art. 52): among them, a fine of up to 2% of revenue in Brazil in the last fiscal year, capped at R$ 50 million per violation, plus warnings, public disclosure of the violation and blocking or deletion of the data.

The ANPD has also made it clear that AI is on its radar. Its Priority Themes Map for 2026-2027, approved by Resolution CD/ANPD No. 30 of 12/23/2025, lists four priority enforcement themes, one of which is "artificial intelligence and emerging technologies" in the context of personal data processing. The 2025-2026 Regulatory Agenda keeps an AI item addressing the right to review automated decisions (LGPD art. 20), and the authority has published a volume of its Technology Radar series dedicated to generative AI. For LGPD basics in daily operations, see our article LGPD in practice for systems and apps.

About PL 2338/2023, the so-called AI legal framework bill: the text was approved by the Senate on 12/10/2024 and moved to the Chamber of Deputies. When we checked the Chamber’s website on 09/30/2026, its status was "awaiting the rapporteur’s opinion in the Special Committee", under priority procedure, with Deputy Aguinaldo Ribeiro as rapporteur. In other words: it is a bill, it is not in force, and the text may still change. Companies that organize themselves under the LGPD now will not lose that work when an AI law arrives.

Internal assistant with data under control

For many companies, a major vendor’s business plan covers day-to-day use. There are cases where it makes sense to go further and have an internal assistant connected to company systems through the API:

• The team needs to ask questions about company documents (manuals, standard contracts, procedures) and you want to control which documents each area can see.
• The work involves customer data and you want ID numbers, names and phones masked before anything is sent to the model, automatically, without relying on each person’s goodwill.
• You need a record: who asked what, when, with which answer, for auditing and for responding to data subjects.
• The task repeats: classifying tickets, summarizing support calls, extracting data from documents. At that point AI stops being a chat and becomes part of the system.

That is the kind of project we build in our artificial intelligence service: assistants and automations that use market models through the API, with access control, data masking and usage logs. If the question is still where to start and how much third-party AI costs per month, the article generative AI for small businesses helps with sizing.

"Banning AI only takes its use out of the company’s sight. Providing the right tool, with a short rule, takes away the risk."

Conclusion

AI is already inside your company, authorized or not. The useful question is not whether the team will use it, but on which account, with which data and under which rules. A personal account for company matters is the worst of both worlds: the company is accountable for the data and has no control over it.

The roadmap is short: list what the team already uses, choose the official tool, publish the one-page policy, train people in half an hour with examples from your own industry and review it every six months. When data volume or sensitivity grows, the internal assistant comes in.

Frequently asked questions

Does using ChatGPT violate the LGPD?

Using the tool, in itself, does not. What may violate the LGPD is processing personal data without a purpose and legal basis, without security measures, or with an international transfer outside the cases in art. 33. Text without personal data (a generic email, a spreadsheet formula) is not personal data processing. Pasting a customer record into a personal account is another story.

Is the company liable for what an employee pasted?

Toward the data subject, the one processing the data is generally the company, as controller, and the LGPD requires repairing harm caused in violation of the law (art. 42). That is why a written policy, training and official tools matter: they are the measures the company can demonstrate. A specific case should be analyzed with your lawyer.

Does ChatGPT train on my company’s data?

It depends on the product. On Free, Plus and Pro accounts, it may train if the model improvement setting is on. For ChatGPT Business, Enterprise, Edu and the API, OpenAI states it does not use data for training by default (official pages checked on 09/30/2026). Google and Anthropic follow the same logic: personal accounts may train, business products and paid APIs do not, by default.

Is PL 2338 already in force?

No. PL 2338/2023 was approved by the Senate in December 2024 and, when we checked the Chamber of Deputies website on 09/30/2026, it was awaiting the rapporteur’s opinion in the Special Committee. Meanwhile, what applies to personal data in AI is the LGPD, enforced by the ANPD.

Do I need an internal assistant or is a business plan enough?

For writing, summarizing and reviewing texts without personal data, a business plan plus the usage policy is usually enough. An internal assistant makes sense when AI needs to query company documents and systems, mask personal data automatically or keep usage logs for auditing.