AI and company data: personal vs business accounts, and 6 basic rules
What changes between using ChatGPT or Gemini with a personal account or a business plan, what OpenAI and Google promise about training on your data and a minimum policy for a small business.
The biggest AI risk in a small company isn’t technical: it’s someone pasting the customer list into their personal chatbot account. The difference between a personal account and a business plan matters a lot.
What providers promise (official pages)
- Google Workspace with Gemini. According to its Privacy Hub, with an eligible edition your interactions stay within your organisation, content isn’t used to train models outside your domain without permission, Gemini only accesses what the user can already see, and admins control how long chats are kept.
- ChatGPT Business, Enterprise and API. According to its enterprise privacy page, OpenAI doesn’t train on your business data by default, encrypts it at rest and in transit, lets you control retention (depending on plan) and offers a DPA for GDPR.
Six basic rules
- Customer, employee or health data: only in company-contracted tools with a processing agreement.
- Personal accounts: only for public or made-up information.
- No passwords, keys or bank details in any chatbot.
- Human review of anything going to customers (hallucinations).
- Watch connectors: granting access to email or Drive widens what the AI can read.
- Your GDPR obligations remain yours (GDPR rights).
An afternoon plan for a small business
- List the AI tools your team already uses (ask without blaming).
- Pick one official tool and review its data terms.
- Write the rule on one page and share it.
- Go through the list of data never to paste with the whole team.
Frequently asked questions
Does ChatGPT Business train on my company’s data?
OpenAI says that by default it doesn’t train on data from ChatGPT Business, Enterprise, Edu or the API unless the company explicitly opts in, and it can sign a DPA for GDPR.
And Gemini in Google Workspace?
Google’s Privacy Hub states that with an eligible Workspace edition your content isn’t used to train generative AI models outside your domain without permission, and Gemini only accesses what the user can already see.
Is a paid plan enough?
Not always: what matters is that plan’s terms. An individual paid plan isn’t a business plan.
Glossary · Safety and good use
Keep reading
Sources
Change log
- : First published with OpenAI and Google official enterprise privacy pages as checked that day.
Educational content, prepared with the help of AI tools, with sources cited. It is not a substitute for professional advice. Tools change fast: if you spot something out of date, write to us at contacto@cognenza.com. How we work.