Can we use ChatGPT, Claude or Copilot on personal data?
Short answer
Yes, it can be lawful – but only if you have a legal basis, use only the data you need, have a data processing agreement (DPA) with the AI provider and have control over transfers outside the EU. The safest route is to let the AI work without the real names: pseudonymise the data before it is sent, and keep the key with you in the EU. Pseudonymised data is still personal data for you.
What does GDPR say?
GDPR doesn't ban AI. But the same rules apply as when you use personal data in other ways:
- You need a legal basis and a clear purpose.
- You may only use the information needed for the task (data minimisation).
- If the AI provider processes data on your behalf, you need a data processing agreement.
- If data is sent to a country outside the EU, the transfer needs a specific basis.
The hard part is data minimisation. If you ask the AI to sort customer enquiries, it needs what the customer wrote – not the customer's name, email, phone number and account number.
Let the AI work without the real names
Pseudonymisation means that names, emails, ID numbers and other details are replaced with fixed codes, such as [PERSON_1], before the data is sent to the AI. The key stays with you. When the answer comes back, the real names are put back in – but only on your side.
This is what it looks like in GoalCube Data Vault. On the left is your data, which stays in the EU. On the right is what the AI sees.
| Customer | Location | Topic | |
|---|---|---|---|
| Sarah Murphy | sarah.murphy@example.com | Cork | Refund |
| Daniel Kelly | daniel.kelly@example.com | Galway | Delivery |
| Claire Walsh | claire.walsh@example.com | Limerick | Complaint |
| Thomas Camilleri | thomas.camilleri@example.com | Sliema | Delivery |
| Emma Byrne | emma.byrne@example.com | Dublin | Refund |
Enquiry Hi, my name is Sarah Murphy and I returned order 7012345678 two weeks ago, but I still haven't received my money. Please transfer it to IE29 AIBK 9311 5212 3456 78. Kind regards, Sarah
| Customer | Location | Topic | |
|---|---|---|---|
| [PERSON_1] | [EMAIL_1] | [STED] | Refund |
| [PERSON_2] | [EMAIL_2] | [STED] | Delivery |
| [PERSON_3] | [EMAIL_3] | [STED] | Complaint |
| [PERSON_4] | [EMAIL_4] | [STED] | Delivery |
| [PERSON_5] | [EMAIL_5] | [STED] | Refund |
Enquiry Hi, my name is [PERSON_1] and I returned order [ID_1] two weeks ago, but I still haven't received my money. Please transfer it to [IBAN_1]. Kind regards, [PERSON_1]
Sarah Murphy and Emma Byrne are waiting for a refund and should get a reply today. Thomas Camilleri has waited 10 days for a parcel. Suggested reply to Sarah Murphy: "Dear Sarah Murphy, thank you for your patience. Your money is on its way and will be in your account within 5 working days."
[PERSON_1] and [PERSON_5] are waiting for a refund and should get a reply today. [PERSON_4] has waited 10 days for a parcel. Suggested reply to [PERSON_1]: "Dear [PERSON_1], thank you for your patience. Your money is on its way and will be in your account within 5 working days."
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| Louise Brennan | 1985-03-12 | 1234567TA | Shannon Timber Ltd | 12 |
| Michael Doyle | 1992-11-02 | 2345678KB | Liffey Logistics Ltd | 4 |
| Maria Borg | 1988-06-21 | 0123488M | Grand Harbour Metals Ltd | 9 |
| David Fenech | 1979-01-30 | 0456779M | Valletta Pharma Ltd | 18 |
CV Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| [PERSON_1] | 40–49 years | [ID_1] | [VIRKSOMHED_1] | 12 |
| [PERSON_2] | 30–39 years | [ID_2] | [VIRKSOMHED_2] | 4 |
| [PERSON_3] | 30–39 years | [ID_3] | [VIRKSOMHED_3] | 9 |
| [PERSON_4] | 40–49 years | [ID_4] | [VIRKSOMHED_4] | 18 |
CV [PERSON_1] has 12 years' experience in budgeting and monthly reporting at [VIRKSOMHED_1]. The person implemented a new ERP system and leads a team of three. Contact: [EMAIL_1].
Louise Brennan and Maria Borg have more than 5 years' experience and should be invited to interview; ask Maria Borg about experience with ERP systems. Michael Doyle has 4 years' experience; the requirement is 5. A person makes the decision.
[PERSON_1] and [PERSON_3] have more than 5 years' experience and should be invited to interview; ask [PERSON_3] about experience with ERP systems. [PERSON_2] has 4 years' experience; the requirement is 5. A person makes the decision.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| Atlantic Components Ltd | Peter Walsh | IE64 IRCE 9205 0112 3456 78 | 2027-01-31 |
| Malta Data Hosting Ltd | Anna Grech | MT84 MALT 0110 0001 2345 MTLC AST0 01S | 2026-12-31 |
| Midlands Precision Ltd | Simon Nolan | IE12 BOFI 9000 0112 3456 78 | 2028-06-30 |
| Celtic Packaging Ltd | Nicole Ryan | IE02 AIBK 9310 6512 9876 54 | 2027-03-31 |
Terms Atlantic Components supplies specialist components for Project Skellig. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact Peter Walsh about any changes.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| [VIRKSOMHED_1] | [PERSON_1] | [IBAN_1] | 2027-01-31 |
| [VIRKSOMHED_2] | [PERSON_2] | [IBAN_2] | 2026-12-31 |
| [VIRKSOMHED_3] | [PERSON_3] | [IBAN_3] | 2028-06-30 |
| [VIRKSOMHED_4] | [PERSON_4] | [IBAN_4] | 2027-03-31 |
Terms [VIRKSOMHED_1] supplies specialist components for [PROJEKT_1]. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact [PERSON_1] about any changes.
Atlantic Components Ltd renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. Celtic Packaging Ltd also renews automatically; the deadline is 31 December.
[VIRKSOMHED_1] renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. [VIRKSOMHED_4] also renews automatically; the deadline is 31 December.
Fictional data. Point at a name or a pseudonym to see what belongs together.
Notice that "She" becomes "The person". Gender is rarely relevant to the task, and it must not be able to influence an assessment.
Try it yourself
Type or paste some text. Add your own secret words – for example a project name or an important customer – and see what the AI would get.
What pseudonymisation doesn't solve
Pseudonymisation is a strong tool, but it doesn't solve everything:
- The data is still personal data for you. You still need a legal basis, agreements and control over deletion.
- Free text can give a person away. "Our only female engineer in Cork" is recognisable without a name. That is why GoalCube shows a re-identification risk for each record.
- The AI can still be wrong. Decisions about people must be made by a person – see the article on human decisions under Article 22 GDPR.
What to do
- Write down the use.What should the AI help with, and what data does it need? This is the first step towards both GDPR and the AI Act.
- Check the legal basis and the purpose.You need a legal basis to process the information, and the new purpose must be compatible with the one it was collected for.
- Check the AI provider.Do you have a data processing agreement? Does the provider use your data to train its models? Where is the data processed?
- Remove what the AI doesn't need.Names, emails, ID numbers, account numbers and addresses are rarely needed to do the task. Replace them with pseudonyms before the data is sent.
- Keep the key in the EU.Show the real names only on your side, for example when the AI's answer comes back.
- Consider an impact assessment.If the AI systematically assesses, say, job applicants or employees, a data protection impact assessment (DPIA) may be required.
What the law says
- Article 5 GDPR – the principles
- Including purpose limitation and data minimisation: use only the information needed for the purpose.
- Article 4(5) and Recital 26 GDPR – pseudonymisation
- Data that cannot be linked back to a person without a key kept separately. Whoever holds the key is still processing personal data.
- Articles 25 and 32 GDPR – data protection by design and security
- Pseudonymisation is named directly as a measure that can protect data subjects.
- Article 28 GDPR – processors
- If a provider processes personal data on your behalf, there must be a data processing agreement.
- Article 35 GDPR – data protection impact assessment
- Required when processing is likely to result in a high risk, for example systematic evaluation of people.
- Article 44 GDPR – transfers outside the EU
- Personal data may only be sent to countries outside the EU/EEA on a specific basis, for example an adequacy decision or standard contractual clauses.
Questions and answers
Is pseudonymised data anonymous?
No. As long as someone – for example you – holds the key to find the real names, the data is still personal data under GDPR. Pseudonymisation reduces the risk but does not exempt you from the rules.
Can we paste a CV straight into ChatGPT?
It can be lawful with a legal basis and an agreement with the provider, but a CV contains a lot the AI doesn't need: name, address, age and often gender. These are exactly the details that can influence an assessment. Remove them or replace them with pseudonyms first.
Does the AI train on our data?
It depends on the service and your agreement. Many business versions don't use customer data for training by default, but check this for your own agreement and settings.
What if the provider is based outside the EU?
Then the transfer needs a specific basis. With pseudonymisation in the EU, the real names never leave the EU – the AI only gets pseudonyms.
Does this also apply to confidential business data?
GDPR only covers personal data, but the same method also protects customer names, contracts, prices and internal project names. In GoalCube you can add your own secret words, which are always hidden.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.