How to protect company data when using ChatGPT or other cloud AI

In March 2023 Samsung discovered that three employees had pasted proprietary source code and confidential meeting minutes into ChatGPT. The case became public, and Samsung temporarily banned the use of generative AI on company devices.

That story is not an isolated incident. Your employees are already using ChatGPT, Gemini, and Copilot to work better and faster. They do it with good intentions. And they do it with NDAs, source code, customer data, and draft contracts — because nobody told them not to. This is called shadow AI, and in most companies nobody is monitoring it.

What actually happens to your data

The distinction that matters is not “data used for training yes/no” — it is “data leaving my perimeter yes/no”.

Consumer ChatGPT (free and personal Plus accounts): by default OpenAI can use conversations to improve its models. This can be disabled at Settings → Data controls. Even with opt-out, data transits through OpenAI’s servers in the US.

ChatGPT Team ($30/user/month): data not used for training by default. Still transits through OpenAI servers.

ChatGPT Enterprise: OpenAI signs a GDPR-compatible DPA, no use for training. Custom pricing, typically from $60/user/month. Data still processes on OpenAI infrastructure.

Azure OpenAI: GPT-4o and o1 models run in your Azure tenant. Data does not leave your infrastructure, DPA is covered by the Microsoft EA/CSP contract, control via Azure RBAC. For most enterprise companies this is the most sensible option.

Ollama on-premise: open-source models (Llama 3.1, Mistral, Phi-3) on internal hardware. Zero data leaving, zero subscriptions, excellent for 70% of text tasks. There is a gap with GPT-4o on complex reasoning, but for summarizing documents, rewriting text, and answering questions on an internal knowledge base, they are more than enough.

The concrete risk with Consumer accounts is not that OpenAI wants to steal your secrets — it is that confidential data transits outside your perimeter in ways you cannot audit, which could violate NDAs, expose GDPR-protected data, or create IP problems around pending patents.

The 3 levels of solution

Level 1 — Zero cost, immediate impact: write and communicate an AI Usage Policy. Most employees don’t realize they’re doing anything problematic. A clear policy, explained in a meeting (not sent as a PDF nobody reads), reduces unconscious risk by 80%.

Level 2 — ChatGPT Team or Azure OpenAI: for teams or departments at high risk (legal, development, HR). ChatGPT Team is straightforward to activate; Azure OpenAI is better if you’re already on the Microsoft ecosystem. Basic setup on Azure:

az cognitiveservices account create \
  --name "myorg-openai" \
  --resource-group "rg-ai-prod" \
  --kind OpenAI \
  --sku S0 \
  --location "swedencentral"

Azure costs are consumption-based — for companies under 500 employees it often works out cheaper than ChatGPT Enterprise.

Level 3 — Ollama on-premise: for the most sensitive data or strict data residency requirements.

curl -fsSL https://ollama.com/install.sh | sh
ollama pull llama3.1:70b
OLLAMA_HOST=0.0.0.0:11434 ollama serve

The policy in 3 rules

You don’t need a 40-page document. You need three rules that people understand and remember:

Forbidden — pasting into non-approved cloud AI: personal data of employees or customers, credentials and API keys, NDA-covered content, proprietary source code
Requires IT approval — using cloud AI for processes that handle customer data at scale, integrating AI into automated workflows
Free to use — using company-approved AI tools, using AI for non-confidential writing and research, using local models (Ollama) for any type of data

Communicate it in a meeting and explain the reasoning. Policies that people understand get followed; ones that arrive as attachments get ignored.

What to do

Monitor DNS logs for 7 days for traffic to chat.openai.com, claude.ai, gemini.google.com, copilot.microsoft.com — measure the phenomenon before reacting to it
Check whether you have a valid DPA with the AI providers your employees are already using (if you don’t know the answer, it is probably no)
Activate ChatGPT Team or Azure OpenAI for the highest-risk departments and give people a safe alternative before banning the unsafe one