ChatGPT Privacy and Security Settings for Work

Before using ChatGPT for work, review its data controls, disable model-improvement sharing if your account offers that option, and avoid entering confidential or regulated information unless your employer has approved the tool and its terms. Also secure your account, check connected apps and custom GPTs, and follow your organization’s rules: settings reduce some risks, but they do not make every work prompt confidential.

Start with your employer’s policy

First establish whether ChatGPT is approved for the kind of work you plan to do. An employer may provide a managed workspace with its own data, access, and retention controls; a personal account may be governed by different settings and terms. Ask your IT, security, privacy, or legal team which account to use and what information is allowed.

Classify the material before pasting it. Public information and generic drafting requests are usually lower risk than internal documents, customer records, credentials, unreleased plans, source code, or personal data. A prompt can disclose information even if you do not attach a file: names, figures, and details in a supposedly anonymized example may identify a person or project.

• Use approved tools and accounts for company work; do not assume a personal account inherits workplace protections.
• Follow your organization’s data-classification and retention rules, including rules for third-party services.
• If a task requires sensitive information, ask whether an approved enterprise workspace or another tool is available.

Review data controls and training settings

In ChatGPT, open your profile menu and look under Settings for Data Controls. OpenAI changes product labels and available controls over time, and options can differ by account or workspace, so confirm what your own interface shows rather than relying on an old screenshot.

Where available, turn off Improve the model for everyone if you do not want new conversations used to improve models. This is a data-use preference, not a promise that conversations are never stored or processed. It also does not override workplace policies, legal obligations, or the service’s applicable terms. For managed business products, data use and administration may work differently; check the workspace terms and administrator guidance.

Review conversation history and any options for exporting or deleting data. Deleting a chat from your view is not necessarily the same as immediate erasure from all systems; retention can depend on product settings, security needs, and applicable terms. Temporary Chat, where offered, is intended not to appear in history or be used for model improvement, but it may still be retained for a limited period for safety purposes. Read the current explanation in the product before relying on it for sensitive work.

Protect the account itself

A privacy-conscious setup can still be undermined if someone else accesses the account. Use a unique, strong password, preferably managed with an approved password manager, and enable multifactor authentication if it is available for your account. If your organization provides single sign-on, follow its setup instructions and security requirements.

• Keep recovery email and phone details current, and protect the email account used for sign-in.
• Do not share a login with coworkers. Use approved workspace membership and roles instead.
• Sign out of shared or public devices, avoid saving credentials on them, and report unexpected login or account activity through the appropriate support channel.
• Be cautious of messages asking you to sign in through an unfamiliar link; navigate to the service directly when in doubt.

Multifactor authentication reduces the risk of password-only account takeover, but it is not a substitute for careful handling of prompts, links, and recovery codes. Never paste passwords, access tokens, private keys, or one-time codes into a chat.

Check files, connectors, and custom GPTs

Files and connected services can expose more than the visible text of a prompt. Before uploading a document, check for comments, hidden sheets, tracked changes, metadata, customer details, and embedded credentials. Share only the pages or fields needed; redact or replace sensitive values where practical, and make sure the remaining details cannot readily identify someone.

Review connected apps or connectors before enabling them. A connector may let ChatGPT retrieve information from another service, subject to the permissions and configuration involved. Use only integrations approved by your organization, understand what data they can access, and remove access you no longer need. Do not connect a personal account to work data simply because the option is available.

Custom GPTs and other third-party tools may have their own instructions, capabilities, and data-handling practices. Avoid sending confidential material to an unapproved GPT or tool. A GPT’s description is not proof that it has been reviewed by your employer; check the provider and your organization’s approval process.

Use safer prompts and verify outputs

Minimize what you disclose. Instead of pasting a complete customer email, remove names, contact details, account numbers, and unique facts, then ask for help with a generalized version. For example, request a neutral template for responding to a delayed shipment rather than supplying a named customer’s full order history.

Give the model only the context required for the task. Replace real project names with labels, use synthetic examples when they work, and keep proprietary code or strategy out of prompts unless the relevant tool and policy explicitly allow it. Remember that a generated answer can be inaccurate or reveal an unintended detail; review it before sharing or using it in a decision.

• Do not treat a “temporary” chat, deleted conversation, or disabled training option as permission to submit restricted data.
• Check generated summaries, citations, calculations, and code against reliable sources and internal standards.
• Remove confidential details from outputs before moving them into email, documents, tickets, or public channels.

Common misconceptions and limits

Turning off model improvement does not mean “nothing is retained.” It changes a particular data-use setting; storage, abuse monitoring, deletion, and retention are separate issues governed by the product and its current terms. Likewise, a private chat is not automatically covered by your employer’s confidentiality arrangements.

Deleting a conversation is not a universal erasure guarantee. The visible chat list, account-level data controls, and system retention are distinct. For work records subject to retention requirements, use your organization’s approved process rather than treating a chat deletion button as a records-management tool.

Finally, no single setting makes a tool appropriate for every task. Sensitivity, contract terms, local requirements, workspace configuration, and the service’s current policies all matter. When the consequences of disclosure would be serious, pause and ask the responsible team before entering the information.

Frequently Asked Questions

Can I use ChatGPT for work if I turn off model training?
Only if your employer permits it and the information is allowed under its policy. Turning off model improvement does not by itself establish confidentiality or eliminate all storage and processing.

Is ChatGPT Temporary Chat safe for confidential information?
Do not assume so. Temporary Chat may have different history and training behavior, but limited retention can still apply, and your employer’s rules remain in force. Check the current product explanation and workplace policy.

Should I use a personal ChatGPT account for company documents?
Use the account and workspace your employer approves. A personal account may not have the organization’s administrative controls, contractual terms, or approved data-handling arrangements.

Does deleting a ChatGPT chat permanently erase it?
Not necessarily from every system immediately. Deletion from the interface and retention under service terms are separate; consult the current data controls and your organization’s records policy.

Can I upload a work file after removing names?
Only when policy allows it. Other details—such as dates, locations, unique events, comments, or hidden spreadsheet data—may still identify people or reveal confidential information.

Related

• Send Windows Defender Events to Wazuh
• How to Block Adult Content at the Router Level
• Windows Store Not Working on Windows 10? Try These Fixes