May personal data be entered into ChatGPT or other AI tools?
By Advisorn · updated on 25 October 2026 · Art. 6, 8, 9, 16, 19, 21 FADP, Art. 4 and 50 AI Act
In short
The FADP applies directly to processing with artificial intelligence too, as the FDPIC has pointed out. Entering personal data into an AI tool means disclosing it to its provider, often in the United States: a suitable contract (Art. 9 FADP), safeguards for the transfer (Art. 16 FADP), security measures (Art. 8 FADP) and correct information to the people concerned (Art. 19 FADP) are therefore needed.
Practical rules for employees
- use only the tools approved by the business, in a business version with a data processing agreement;
- check that the data entered is not used to train the provider's models;
- do not enter sensitive personal data or information covered by secrecy;
- remove names and details that identify people when they are not needed;
- check the results before using them, above all when they concern a person.
If the AI decides
If a decision that has a legal consequence for a person or significantly affects them is taken solely by an automated system, the person must be informed and may ask for the decision to be reviewed by a natural person (Art. 21 FADP).
Those who also work in the EU must take into account the European regulation on AI (AI Act), which requires among other things that those who use these systems be trained (Art. 4).
Related questions
Useful templates
General information, not advice on your case: for your case the text of the law prevails. For a question about your case there is Advisorn's consulting.