Is ChatGPT safe for confidential information?
It depends on the plan. On ChatGPT Business and Enterprise, OpenAI says it doesn't train its models on your data by default. On the free and personal plans, conversations can be used to improve OpenAI's models unless the person turns that off. Keep confidential work to a business account your business controls.
Does ChatGPT store or share your data?
Conversations appear in your chat history. Temporary chats don't, and OpenAI says they may be kept for up to 30 days for safety purposes. On the business plans, OpenAI encrypts data at rest and in transit, offers a data processing addendum and doesn't train on business data unless you opt in.
On a personal plan, the setting is under Settings, then Data controls, called "Improve the model for everyone".
Is Copilot safe for confidential information?
Microsoft 365 Copilot works inside your own Microsoft 365, and Microsoft says it doesn't use your prompts, responses or files to train the AI models behind it. It only shows people what they can already open, so the risk is files shared too widely: if a salary spreadsheet is open to everyone, Copilot can surface it to anyone.
The Copilot readiness guide covers how to find and fix files that are shared too widely.
Does Copilot store your data?
Yes. Copilot keeps each person's prompts and responses as their activity history, encrypted and covered by the same contract as your other Microsoft 365 content. Your admin can set how long it's kept, and people can delete their own history. Outside the EU, Microsoft says queries may be processed in the US, the EU or elsewhere.
Personal accounts or business accounts?
What happens to your data depends on the plan, so it's worth knowing which one each person uses. This table was checked on 05/10/2026 against the vendors' own pages.
| Plan | What happens to your data |
|---|---|
| Free or personal ChatGPT | Conversations can be used to improve OpenAI's models unless the person turns that off. Your business doesn't control the account. |
| ChatGPT Business or Enterprise | Not used to train OpenAI's models by default. Data is encrypted, and a data processing addendum is available. |
| Microsoft 365 Copilot, with a licence | Not used to train the models behind it. It only shows people what they can already open, and your admin sets how long history is kept. |
What should never go into an AI tool?
Even on a business plan, keep out passwords, bank and card details, health and other sensitive personal data, and anything covered by a confidentiality agreement, unless the tool is approved for it and your data protection lead agrees. Write the list into your AI policy so nobody has to guess.
The free AI policy template has the list ready to adapt.
What should you check before anyone pastes work in?
Check that everyone uses a business account, that training on your data is off, that files in Microsoft 365 aren't open to everyone, and that you know where the data is processed. Then name who checks the output, and decide whether you need a data protection impact assessment (DPIA).
- Everyone uses a business account, not a personal one.
- Training on your data is off, or off by default on your plan.
- In Microsoft 365, files aren't shared with the whole business unless they should be.
- You know where the tool processes data, and it fits your rules.
- Someone checks every output before it's used or sent.
- If personal data goes in, you've decided whether you need a DPIA.
If personal data goes in, the DPIA template for AI projects walks you through the assessment.