Short answer: not by default. What happens to what you paste depends on your plan, and where the data goes is a question most small firms have never asked.
Short answer: No, not by default. ChatGPT is safe enough for ordinary work, but it is not built to hold confidential material, and two separate questions decide whether a given paste is a problem: what the provider does with it, which depends entirely on which plan your team is on, and whether sending it there was a lawful disclosure in the first place.
Key takeaways
People say "ChatGPT" for several different products with different rules: the free tier, a personal paid subscription, a business or enterprise plan, and the API. Business and enterprise plans generally offer stronger commitments about retention and training than consumer ones do, but the specifics differ between providers and change over time.
So the first practical step is unglamorous: find out which plan your team is actually on. In a small business the answer is very often "everyone has their own free account", which is the weakest position available and the one nobody chose deliberately. It happened because the business never bought anything and people needed to get work done.
Check the current terms for your plan rather than trusting a summary, including this one. These policies are revised regularly, and a claim about retention that was accurate last year may not be now.
Most articles on this topic stop at the provider's terms. That covers what happens to the data once it arrives. It does not address whether you were permitted to send it, which in several jurisdictions is a separate obligation that attaches to you rather than the provider.
Australia. APP 8 requires an entity to take reasonable steps to ensure an overseas recipient does not breach the Australian Privacy Principles before personal information is disclosed to them. Section 16C then makes the disclosing entity "accountable for an act or practice of the overseas recipient that would breach the APPs". That accountability applies even where reasonable steps were taken, subject to specific exceptions. Practically: you cannot outsource the consequence to the AI provider.
New Zealand. IPP 12 allows disclosure outside New Zealand only where the recipient is subject to the Privacy Act, will adequately protect the information (model contract clauses, for example), or is subject to comparable privacy laws. Failing that, you need the individual's express permission after telling them the protections may not be equivalent. The Privacy Act 2020 has no small-business exemption, so this applies to a sole trader.
European Union. Transfers outside the EEA need an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a derogation. The Commission's framing is that "the protection travels with the data".
United States. There is no general federal rule of this shape. Sector rules such as HIPAA constrain particular data, and the FTC Act's prohibition on unfair or deceptive practices carries no size exemption, including an obligation to maintain security appropriate to the nature of the data you hold.
Whether any of this binds you turns on where you operate and how big you are, which we cover separately in whether privacy law applies to your small business. The point here is narrower: the terms of service are not the whole question.
Treating "confidential" as a single category is why policies fail. Sorting it by consequence is what makes a rule usable at speed.
Credentials: API keys, passwords, access tokens, connection strings. The most serious and least discussed. A leaked key is not a privacy incident, it is an unlocked door. It can be used by anyone who obtains it, immediately, and rotating it is the only fix. Nothing else on this list is exploitable that directly.
Identity documents and financial details: passport and licence numbers, bank details, card numbers, tax file numbers. Difficult or impossible for the person affected to change, which is what makes the harm durable. This is also the category most likely to trigger a breach-notification duty: in New Zealand, a breach likely to cause serious harm must be reported to the Privacy Commissioner and the affected people as soon as you are practically able.
Client work product: drawings, tender pricing, contracts, case details. Usually covered by your engagement terms and professional obligations whether or not privacy law applies to you.
Ordinary business context: a company name, a general question about an industry. Usually fine, and treating it as dangerous is exactly what makes people ignore the whole policy. A rule that flags everything trains people to dismiss it.
For confidential material to be genuinely safe in an AI tool you would need to know: what is retained and for how long, whether humans review it, whether it trains a model, where it is stored, who else can reach it, and who you would have to tell if it were exposed.
For a business or enterprise plan you can find most of those answers, and they are usually acceptable. For a personal free account used for work you generally cannot, and the burden of the unknown sits with you rather than the provider.
Most small firms land somewhere sensible once they stop treating this as binary: use AI freely for the ninety per cent of work that is not sensitive, buy proper accounts so there is one set of terms to reason about, and stop the specific things that cause real damage from going in.
That last part is a control problem, not a policy problem. People do not paste a client's bank details into a chat window because they are careless. They do it because they are working quickly and the field looks like any other text box. Training helps for a fortnight, then the pressure comes back.
What works better is something that notices at the moment it happens. Prinn runs on each person's computer and checks a prompt before it is sent. If it finds an API key, a card number, a passport number or similar, it shows what it found and offers three choices: redact it, stop, or send it as is. It never blocks anyone and never sees the prompt content itself, and nothing is sent to Prinn. An owner sees the category, the tool, the date, the device and the choice made, without reading anyone's prompts.
It reliably catches credentials, financial details and identity numbers. Names, home addresses and dates of birth written into ordinary prose are harder, and it is still improving at those. Worth knowing before you rely on it.
Prinn is not legal advice and does not make you compliant with anything. It reduces the chance of an accidental disclosure and shows you where one nearly happened.