An employee pasted personal data into ChatGPT. What do we do now?
Short answer
Stay calm and act fast. Find out which data was sent, to which service and on which plan. Delete the conversation and switch off training. Assess whether it is a personal data breach: if it is likely to result in a risk to the people concerned, report it to your supervisory authority within 72 hours. If the risk is high, the people must be told too. Always document the incident – even when you don't have to report it – and learn from it.
What counts in the assessment?
| Raises the risk | Lowers the risk |
|---|---|
| Sensitive data, national ID numbers, bank account numbers | Only names and work email addresses |
| Many people | Few people |
| Free plan with training | Business plan with no training and an agreement |
| Data cannot be deleted | The conversation has been deleted |
Prevent it instead
With GoalCube, staff can use AI on real data because the AI only sees codes. And if a name still slips into the AI's answer, GoalCube's leak check spots it.
What to do
- Stop further sharing.Ask the employee to stop and take a screenshot.
- Work out the scope.Which data, how many people, which service and plan.
- Limit the damage.Delete the conversation, switch off training and contact the provider if you can.
- Assess the risk.Sensitive data, ID numbers or many people raise the risk.
- Report it if there is a risk.To your supervisory authority within 72 hours of becoming aware of the breach.
- Document and learn.Every breach must be documented internally. Update your policy and training.
What the law says
- Article 33 GDPR – notification to the supervisory authority
- Within 72 hours, unless the breach is unlikely to result in a risk.
- Article 34 GDPR – communication to the data subject
- When there is a high risk to people's rights.
Questions and answers
Is it always a breach?
Not always. If the data went to a business plan with a data processing agreement, it may be a mistake about purpose rather than a breach. Assess each case on its facts.
How do we stop it happening again?
A good alternative: an approved tool where the AI only sees pseudonyms, so it doesn't matter that the employee uses real data.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.