If you’re wondering what not to paste into ChatGPT at work, the short list is this: client data, personal details of customers or colleagues, passwords and API keys, unreleased financials, and source code your employer hasn’t cleared. The tool matters less than the account. A personal free account and a company-managed one follow different rules, and your employer’s policy sits on top of both. Claude and Gemini work the same way.
Most of us are already doing this. EY’s 2025 Work Reimagined survey found that 62% of Indian employees use generative AI regularly. The question is what goes into the box.
Key takeaways
- The account type matters as much as the data. Personal and work plans follow different rules.
- Your company’s approval does not mean your client has agreed. Check the client contract.
- Replace names, numbers and amounts with placeholders before you paste.
- If you can’t find the rule, ask in writing before you paste.
What Not to Paste Into ChatGPT at Work: The Short Answer
Run three checks before you hit enter.
Is it mine to share?
If a client, customer or colleague gave you the information, it may not be.
Is this account approved?
A tool your company pays for and manages is a different thing from your personal login.
Can I strip the identifying parts and still get help?
Usually you can. Names, numbers and account details rarely change the answer you need.
Companies have acted on this. India’s finance ministry reportedly told staff in an advisory dated 29 January 2025 to avoid ChatGPT, DeepSeek and similar tools on office devices (Reuters reported it). That was one ministry, not an India-wide rule. In 2023, media reports said Samsung restricted staff use of generative AI after employees shared internal code. Both are reported cases, and neither tells you what your own employer allows.
Check the Account Before You Check the Data
The same chatbot can treat your text very differently depending on how you log in. Personal plans usually give you a privacy setting to manage. Work plans are usually governed by a company contract, and your admin controls the settings.
| Tool | Personal account | Work or business plan |
|---|---|---|
| ChatGPT | Check Data Controls for the setting that lets your chats improve the model, and switch it off if you don’t want that. | OpenAI says business plans are not used for training by default. Ask your admin which plan you’re on. |
| Claude | Anthropic’s consumer plans have a choice on model improvement. If you allow it, chats can be kept for up to five years. If you don’t, the retention period is shorter. | Team, Enterprise and API use are covered by commercial terms, not the consumer setting. |
| Gemini | Look at Gemini Apps Activity in your Google account. It controls whether chats are saved and reviewed. | Workspace admins manage Gemini for their organisation. Your admin decides what is on. |
Two cautions. First, these settings change, so read the vendor’s current page rather than trusting a table, including this one. Second, a “temporary” or “incognito” chat is a privacy feature on a personal account. It does not turn that account into one your company has approved.
Personal use at work is common, though it may be falling. Netskope’s India report, as covered by CXOToday and Business Standard, says the share of employees using personal AI accounts at work dropped from 79% to 41%. That is one vendor’s figure from its own customer data, so treat it as a signal, not a national number.
What Never to Paste (and What’s Fine)
A note on Aadhaar. UIDAI issued an advisory on sharing Aadhaar photocopies in May 2022 and withdrew it within days, so its guidance has shifted before. Check UIDAI’s current page. Whatever it says, no task needs someone’s Aadhaar number pasted into a chatbot.
When in doubt, swap the real thing for a placeholder. A ready-to-copy example is in the safer-way section below.
If It’s Your Client’s Data, Your Company’s Permission Isn’t Enough
This is the part most office guides skip. Your company may approve a tool for internal use. That does not mean your client has agreed to their data going through it. Many service contracts and NDAs limit what a vendor can pass to third parties, and an AI provider can count as one.
So the order of questions is: what does the client contract say, what does my company’s policy say, and only then, what does the tool’s privacy setting say. If you can’t find answers to the first two, don’t paste. Ask your manager or IT team, and get the reply in writing.
Company policies on this are all over the place. Some Indian IT firms publish their AI-use rules and some keep them internal. If yours is silent, that is not permission. It usually means nobody has decided yet.
Where the DPDP Act Actually Stands in 2026
People often say the DPDP Act already bans pasting data into AI tools. It doesn’t, and it isn’t a chatbot law. It governs how organisations handle personal data, and most of its duties haven’t started yet.
11 August 2023
DoneThe Digital Personal Data Protection Act received presidential assent.
Mid-November 2025
DoneThe DPDP Rules, 2025 were notified (PIB gives 14 November; some law firms say 13 November). The Data Protection Board and definitions took effect.
About November 2026
UpcomingConsent manager provisions are due to begin.
About mid-May 2027
UpcomingThe core duties for organisations are due to begin. Sources give 12, 13 or 14 May, so check the Gazette.
Until the core provisions begin, law firms such as Hogan Lovells and DLA Piper note that the IT Act and the 2011 SPDI Rules continue to apply. MeitY floated shortening the timeline to 12 months in January 2026. Coverage we found as of October 2026 still describes the shorter timeline as a proposal. Dates can move, so confirm on MeitY’s site before you rely on any of this.
What it means for you: the penalties in the Act, up to ₹250 crore for failing to keep security safeguards, up to ₹200 crore for not reporting a breach or for failing on children’s data, and up to ₹50 crore for other breaches (per PIB), fall on the organisation that handles the data. They are written for organisations, not individual employees, though your employment contract and other laws can still apply to you. A company also stays responsible for personal data it hands to an outside tool. That is why it may discipline you, and why a client may end a contract.
A Safer Way to Use AI at Work (With a Redaction Template)
You don’t have to stop using AI. You have to change what goes in. The habit is simple: describe the situation, don’t paste the records. Swap every name, ID number, account detail and amount for a placeholder, get your draft, then fill the real details back in yourself.
Template 1: Redaction before and after
Before (don’t paste):
“Draft a payment reminder to Rohan Mehta, PAN ABCDE1234F, who owes ₹4,82,000 on invoice 2291.”
After (safer):
“Draft a polite payment reminder to [Client A] for [Amount] on [Invoice no.], overdue by 30 days. Keep it under 120 words.”
Fill the real details back in yourself after the draft comes back.
Redaction covers the data. It doesn’t cover permission. For that, ask. The message below takes thirty seconds to send and gives you something in writing.
Template 2: Message to your manager or IT team
“Hi [Name], I’d like to use [ChatGPT / Claude / Gemini] for [task, e.g. drafting emails or debugging code]. Can you confirm: (1) which account or plan I should use, (2) whether client data or code from [Client/Project] may be pasted in, and (3) whether there is a written AI-use policy I should follow? Until I hear back, I’ll only use public or fully anonymised content. Thanks, [Your name]”
What Works and What Doesn’t
| What works | What doesn’t |
|---|---|
| Using a company-managed account with admin settings you can ask about. | Assuming incognito or temporary chat makes a personal account company-approved. |
| Swapping names, PAN numbers and amounts for placeholders. | “It’s just a small snippet.” A few lines of client code or a single contract clause can still be confidential. |
| Asking your manager or IT team in writing and keeping the reply. | Treating silence in the policy as permission. |
| Changing the privacy setting on a personal account to limit training use. | Deleting a chat after pasting. Deletion is not instant. Anthropic, for example, says deleted consumer chats leave its back end within 30 days. |
Honest limit: redaction lowers the risk but doesn’t remove it. A description with enough detail can still point to a specific client or person, even without a name. And none of this replaces your employer’s actual policy.
Mistakes to Avoid
- Pasting a whole email thread. Signatures, phone numbers and earlier replies come along with it.
- Uploading screenshots or full files. Images, PDFs and spreadsheets are data too, including the columns you forgot were there.
- Pasting error logs as they are. They often hold internal URLs, usernames or keys.
- Using a personal account on a work laptop for client work. That mixes the two and breaks most policies.
- Sending AI output on without checking it. The draft is yours once you send it.
Three Myths Worth Dropping
- “Paying makes it private.” A paid personal plan is still a personal account. What matters is whether it is a business plan managed by your company.
- “Nobody reads my chats.” Vendors describe limited human review, for example of chats flagged for safety. Anthropic says flagged consumer chats can be kept for two years. Assume your text is stored, and some of it may be seen.
- “The DPDP Act already makes this illegal.” It doesn’t mention your chatbot, and its main duties start later. Contracts and company policy are what bind you today.
The Takeaway Before You Paste
What not to paste into ChatGPT at work comes down to one habit: check the account, check who owns the data, then strip what you can. The same goes for Claude and Gemini. Use this before your next paste.
Before you paste: 6-point checklist
☐ Is this an account my company approved?
☐ Did anyone outside my company give me this information?
☐ Does the client contract or NDA allow third-party tools?
☐ Have I removed names, ID numbers, account details and amounts?
☐ Is there a password, key or token anywhere in the text?
☐ Could I explain this paste to my manager without worry?
Frequently Asked Questions
Is it safe to use ChatGPT for office work in India?
It can be, if you stay within your employer’s policy and your client contracts. Use an approved work account, remove names and identifiers, and never paste passwords, client data or personal details of other people. Safety depends more on what you paste and which account you use than on the chatbot itself.
Can my company see what I type into ChatGPT?
It depends on the setup. Office devices and networks can often be monitored, and business plans may give admins audit tools. On a personal account the vendor doesn’t share your chats with your employer by default, but a monitored laptop or network can still reveal them. On an office device, assume your company can see it.
Is ChatGPT banned in Indian offices?
There is no India-wide ban. India’s finance ministry reportedly advised its own staff in January 2025 to avoid ChatGPT, DeepSeek and similar tools on office devices (as reported by Reuters). Private companies set their own rules, so check yours.
Last updated: 16 October 2026. This is general information, not legal advice.
Sources: OpenAI, enterprise privacy · OpenAI, how your data is used · Anthropic, model training · Anthropic, data retention · Google, Gemini privacy hub · PIB, DPDP Rules 2025 · Hogan Lovells, DPDP Act in force · DLA Piper, data protection in India · Storyboard18, MeitY’s 12-month proposal · Reuters via Yahoo, finance ministry advisory · Forbes Australia, Samsung ban · CXOToday, Netskope India data · Business Standard, shadow AI · EY, 2025 Work Reimagined survey · Moneylife, UIDAI withdraws advisory