Is ChatGPT safe for confidential information?
By the InTheory team · Updated November 2026
It depends on the plan and your rules. OpenAI states that ChatGPT Business and Enterprise do not train its models on your business data by default, and offer admin controls. Personal accounts have different settings. Even on a business plan, regulated or privileged client data needs clear policies, and some information should not go in at all.
What changes the risk
The account type, who controls it, and what goes in. A company-managed workspace with single sign-on lets you control who has access and remove it when someone leaves. Personal accounts, often paid on a staff member's card, sit outside your control. Also consider what the tool connects to: linking it to shared drives or email widens what it can see.
Rules for regulated work
Law firms should consider attorney-client privilege and the guidance in ABA Formal Opinion 512 on generative AI. Health practices must think about HIPAA, which typically requires a business associate agreement before protected health information goes to a vendor. Tax and accounting firms have duties under IRS Publication 4557 and the FTC Safeguards Rule. This is general information, not legal advice.
A practical policy names the approved tool and plan, lists data that never goes in, requires review before anything reaches a client, and explains where to report mistakes. InTheory helps service businesses write and roll out exactly this kind of policy.