Can Consultants Use ChatGPT With Client Data? NDAs and Settings

Yes, consultants can use ChatGPT with client material, but only when the engagement terms and the client permit that disclosure and the chosen workspace meets their data requirements. Check the NDA, get written approval where needed, choose the correct plan and app settings, minimise what you paste, and review every output before it reaches the client.

A model-training switch answers only one question: whether material may be used to improve a provider's models. It does not amend an NDA, grant permission to send confidential information to a supplier, remove saved chats, or make connected apps part of the client's approved supplier list. Treat contractual permission and technical controls as two separate gates.

Follow me on Instagram@sagnikteaches

Read the engagement paperwork before opening a chat

Find the signed NDA, engagement letter, statement of work, data-processing terms and any client information-security or AI-use policy. The documents may disagree or have been revised after the project began. Identify which one governs the information you want to use, who can approve a new tool, and whether the client has already approved a named supplier or category. A verbal "AI is fine" from a project contact is weak evidence if the contract requires written consent from procurement or the legal team.

Connect on LinkedInSagnik Bhattacharya

Make a one-page decision record with six fields: information category, permitted purpose, permitted recipients, supplier or subprocessor approval, required security controls, and deletion or return rule. Record the clause or policy section beside each answer. If a clause says the consultant may disclose information only to employees and named subcontractors, do not assume a general software subscription fits. If the agreement permits approved processors but requires a written schedule, ask for that schedule. The specific contract determines the answer; a qualified solicitor should resolve ambiguous wording before sensitive material is uploaded.

Subscribe on YouTube@sagnikteaches

For example, an illustrative care agency's NDA might allow disclosure to approved service providers solely to prepare a staffing review, while its separate policy bans uploading identifiable care records to any generative AI service. Those rules permit a discussion of anonymised rota patterns only if the client confirms the proposed use. They do not permit pasting a named service user's incident narrative. The contract and policy must be read together, rather than selecting the more convenient sentence.

Where the contract is silent, ask a bounded question instead of requesting blanket permission: "May our team use a managed ChatGPT Business workspace to summarise redacted interview themes for the agreed diagnostic, with no names, raw transcripts or connected client drives? We will review all outputs and remove the working chats under the agreed retention rule." A yes to that request does not cover later uploads of unredacted payroll or a new app connection. For broader NDA clause analysis, see the clause test for partner information and ChatGPT.

Choose the workspace by the data rule, not the logo

ChatGPT personal workspaces and managed business workspaces have different defaults. OpenAI's current data-controls guidance says data sharing for model improvement is enabled by default in personal Free, Plus and Pro workspaces. A signed-in user can turn off Improve the model for everyone through Settings and Data controls; regular chats can still remain in history. The same guidance says Business and Enterprise workspace content is not used to train OpenAI models by default. Check the workspace selector before every client session: a chat started in your personal workspace follows that workspace's settings, even if you also hold a Business seat.

A training opt-out on a personal account may be useful for low-risk drafting, but it is not an automatic substitute for a managed workspace. Check whether the client requires a data-processing addendum, administrative access controls, agreed retention, supplier assessment or an audit trail. OpenAI says it can execute a data-processing addendum for Business and Enterprise customers; whether the client's paperwork requires one is an engagement question. The enterprise privacy page describes its business data handling and retention approach, but your signed terms and current workspace configuration remain the documents to verify.

Temporary Chat is another narrow control. OpenAI says a temporary chat does not appear in history, does not create or update memories and is not used for model improvement while it remains temporary; a copy may be kept for up to 30 days for safety. If a temporary chat is saved, it becomes a regular chat subject to the account's settings. None of this makes an unauthorised client disclosure permissible. It can also be a poor fit if the client requires a reviewable record of what information was used and how a finding was checked.

Use a plan decision that can survive a client review. For public material and fictitious examples, a personal workspace may be enough if its settings suit your policy. For approved but confidential client information, use the client-approved managed workspace and complete any supplier paperwork. For a prohibition on external AI processing, keep the material out of ChatGPT even if a Business seat is available. For material whose classification is uncertain, pause the upload and ask the client owner. A pricing comparison alone cannot decide these cases; the separate managed-seat comparison for consultants covers the subscription choice.

Reduce the input until it contains only the job to be done

Redaction is a deliberate transformation, not a find-and-replace on the client name. Start by writing the output you need in one sentence, such as "group ten interview observations into three themes" or "rewrite this approved public paragraph for a board audience". Then list the minimum facts the model must see to do that task. Remove everything else before pasting. Keep the unedited source in the client's approved system and give ChatGPT a working excerpt or structured summary rather than an entire document.

Remove direct identifiers first: names, email addresses, telephone numbers, account references, staff IDs, exact addresses and document links. Then look for indirect identifiers: a rare job title, a precise event date, the only branch with a certain service, a distinctive quotation or a revenue figure that appears in public accounts. Generalise these where the task permits. If the identity is still obvious to someone who knows the project, call the material pseudonymised rather than anonymous and apply the confidentiality rule that still covers it.

Here is an illustrative music school example. The raw note says, "[first name] at the only evening percussion class missed three instalments of $87 and asked for a hardship waiver on 14 October." A safer input for a process-design task is, "One family in a small group programme missed three monthly payments and asked for a concession; propose a neutral reminder and escalation process." The exact class, amount, date and family identity did not help draft the policy. If the amount is needed to calculate arrears, do the arithmetic in the approved spreadsheet and send only a rounded total after checking that the group is large enough to avoid identification.

Keep a mapping outside the chat when tokens must be reconciled later. A local or client-approved table can map "Branch A" to the real branch and "Theme 2" to its evidence references. Do not upload the mapping alongside the redacted text. A second team member should perform a reconstruction test: given the redacted prompt, the project's public facts and ordinary internal knowledge, could they identify the organisation or individual? If yes, remove or generalise more, or seek explicit permission to process the identifiable information.

Sometimes redaction destroys the task. A consultant asked to compare whether a client's top five products are overpriced cannot make a useful recommendation from five identical "Product X" rows with every price replaced by "value". In that case, use a client-approved tool and scope, work within its system, or analyse the data manually. A fabricated dataset can test the prompt format, but it cannot stand in for a real commercial conclusion. This is a practical limit, not a prompt-writing problem.

An optician case from permission to final draft

Consider an illustrative consultant preparing a service-capacity note for an optician with four branches. The client supplies a monthly table of 1,240 appointments, 93 unattended slots and 184 reschedules, plus comments from 16 staff interviews. Two comments mention named colleagues and one identifies a customer complaint. The consultant wants ChatGPT to help draft a two-page narrative about scheduling friction, not decide staffing levels or publish any individual account. The engagement lead first confirms in writing that approved, minimised operational aggregates may be processed in the consultancy's managed workspace for this task.

Before upload, the consultant checks that the appointment totals reconcile: 1,240 scheduled appointments, of which 93 were unattended, gives an illustrative unattended rate of 7.5% when rounded to one decimal place. The 184 reschedules may overlap with appointments later attended, so adding them to the 93 would be a false "lost appointments" total. The source table has branch subtotals of 300, 315, 305 and 320 appointments; those sum to 1,240. If they summed to 1,236, the four missing records would be investigated in the source system rather than explained away by a model.

The consultant extracts eight short, de-identified observations from the 16 interviews, discarding personal names and the unique customer incident. A prompt asks for themes grounded only in those observations and for a column of unresolved questions. The illustrative response says, "Branches with the highest unattended rate have the longest reminder delays." That sounds plausible but the supplied data contains only a combined unattended count, no branch rates and no reminder timing. The consultant removes the unsupported causal sentence, marks it as a question for the operations lead and keeps a source note showing which interview observations support each remaining theme.

The final draft contains the verified 7.5% rate, a statement that reschedules are a separate measure, three cautiously worded themes, and two requests for missing data. The consultant checks it against the original table and interview notes in the client's approved repository, then sends the reviewed narrative through the agreed client channel. The raw interviews, token mapping and customer complaint never enter ChatGPT. The complete decision record says who approved the use, which workspace and input were used, what was removed, who reviewed the output and when the working chat should be deleted.

Prompt with an evidence boundary built in

A prompt should constrain the model's job and make unsupported statements visible. It cannot enforce a contract, but it can make an approved task easier to review. Keep the instruction short enough that a colleague can inspect it. Put the classification and permission check outside the prompt; do not ask the model whether your upload is lawful after you have already uploaded the disputed material.

You are drafting a section of a client-approved operations note.
Use only the de-identified observations below. Do not infer an
individual's identity or invent dates, causes, figures or quotations.
Return a table with: theme; source observation IDs; cautious draft
sentence; missing evidence. Label any hypothesis as a hypothesis.

Observations:
O1: Staff reported that reschedule requests arrive through two channels.
O2: The booking team checks both channels at the start of each shift.
O3: Two interviewees described duplicate follow-up messages.
O4: The current report combines attended and rescheduled bookings.

An illustrative output might say: "Theme: fragmented reschedule intake; evidence: O1 and O2; draft: staff described two intake channels and a manual check at shift start; missing evidence: count of requests by channel." That sentence stays within the supplied observations. Another output might say "The double-entry process causes 20% of missed slots." No missed-slot percentage appears in O1 to O4, so delete that claim and ask for source data. This source-ID method is especially useful when a finding will be challenged in a steering meeting.

For a separate, illustrative veterinary practice engagement, the consultant could ask ChatGPT to group twelve de-identified reasons for appointment cancellations. If the model collapses "animal recovered" and "owner could not travel" into one "lack of demand" theme, the consultant splits them back into distinct operational causes. Keeping the original reason codes next to each draft category makes that error visible. The practice decides what the categories mean; the model offers a draft grouping.

Connected apps can widen the disclosure

Apps (formerly connectors) can retrieve information from a drive, inbox or other service. OpenAI's connected-app guidance says the data available depends on the connection, the account's existing access and workspace controls. It also says information shared with a third-party app is handled under that app's own terms and privacy policy, and that in ChatGPT Business many apps are enabled by default unless an administrator changes workspace access. The fact that OpenAI does not train on Business workspace content by default does not approve every connected supplier, nor does it narrow an over-broad drive permission.

Suppose an illustrative consultant has access to 900 client files in a shared drive but needs only six approved policy drafts. A broad connection could make much more information retrievable than the six files. The safer workflow is to use a client-approved folder with just those drafts, inspect the connection's requested permissions, keep the app disabled if the client has not approved it, and disconnect it when the work ends. If a simple pasted excerpt is sufficient, there may be no reason to connect the drive at all. Record the app name, account, authorised scope and date of review in the decision record.

Also check sharing, memory and output destinations. A shared conversation may include uploaded material or generated summaries; review it as carefully as an email attachment. Business teammates do not automatically see one another's private chats, but that does not make a chat a personal vault outside workspace governance. Memory and personalisation can influence later work; review the workspace's settings if the client wants strict separation between engagements. Keep one approved project or workspace context per client when that matches policy, and verify you are in it before uploading.

A consultant preparing a public sales deck for a care agency might paste a draft containing a client-approved service description. The same consultant should not allow an app to pull the agency's entire staff directory merely to polish the deck. The scope of the request, the account's permissions and the third-party app's terms all matter. If an app is necessary, ask the client to approve that particular app and use, not just "ChatGPT" in general.

What to tell the client before and after use

Clients rarely need a long AI policy for one bounded assignment. They do need a clear description of the material, purpose, tool, workspace, safeguards, reviewer and retention. Put these in an engagement addendum or approval email. The wording must match the actual process; do not promise "no client data leaves our systems" if content goes to an external provider. If the client restricts subcontractors, procurement or legal should confirm whether the provider and any connected app fit the contract's definitions.

For the agreed operations diagnostic, we propose using our managed ChatGPT workspace to draft themes from de-identified interview excerpts and approved aggregate figures. We will not upload names, raw recordings, customer records or the token mapping. A consultant will compare each statement with the source material before delivery. We will use no connected client apps without separate approval and will handle working chats under the retention rule agreed for this engagement. Please confirm whether this use and the workspace are approved under the engagement terms.

That is illustrative wording, not a substitute for the signed agreement. If the client approves only redacted data, keep the approval email with the redaction protocol. If they approve a managed workspace but no apps, record that boundary. If they ask for deletion after handover, set a date and an owner. If they decline, use ChatGPT for public research, fictitious scenarios or generic structure only. A client can still receive a well-written report without its confidential material ever entering a model.

One illustrative music-school client may approve the consultant using a generic parent-enquiry template but prohibit uploading family emails. Another may allow aggregated term-by-term enrolment counts after small cohorts are combined. These are different permissions. Record the exact accepted use, because a later team member may otherwise treat approval for drafting a generic template as permission to upload a spreadsheet of named pupils. For a proposed AI-use clause in an engagement letter, see the consulting engagement-letter wording tutorial.

Check the output and keep an audit trail you can explain

Review for disclosure first: did the answer reproduce a sensitive phrase, reveal a token mapping, refer to a different client's context, or include a detail you deliberately excluded? Then review accuracy: do every number, attribution, quotation and recommendation trace back to approved source material? A fluent paragraph is not evidence. Use source references or observation IDs in the working draft, and remove them from the client-facing version only when the final report's citation style requires it.

A simple review register has one row per material claim: draft sentence, underlying source, calculation if any, reviewer, and disposition. For the optician example, "93 of 1,240 appointments were unattended" has the monthly export as its source and a checked rate of 7.5%. "Reminder delays drove missed appointments" has no supporting data, so its disposition is "remove and ask for reminder timestamps". This register takes longer than accepting a polished draft, but it is the part that makes the consultant's judgement visible.

Another illustrative error is a fabricated quote. An AI summary of anonymised staff notes says, "We never see the reschedule inbox until Tuesday." The source merely says one team checks two channels at shift start; it contains no Tuesday and no verbatim quote. Replace the sentence with a paraphrase tied to O1 and O2. Even if the invented quote seems harmless, presenting it as a client's own words could damage trust and distort a recommendation.

At handover, retain the approval, the input description, the redaction method, the prompt and final output where the client agreement permits, and the review register. Follow the agreed retention and deletion rule for chats and working copies. Do not imply that clicking Delete necessarily proves instant erasure across every system; check the provider's current retention terms and the signed agreement. If the client needs a stronger audit or deletion commitment than your selected plan provides, choose a different approved route before processing the data.

If someone pasted the wrong file, act on the actual exposure

Stop using the chat and prevent further sharing. Capture the facts without forwarding the sensitive file again: which workspace and account, the file or extract involved, when it was uploaded, whether a connected app was invoked, whether the chat was shared and whether it was saved. Notify the engagement lead and follow the client's contractual incident process. Legal or privacy specialists can determine whether an external notice is required. Avoid telling the client "it is safe because training is off"; that statement does not answer who received the material or what the contract required.

For example, a consultant meant to paste a six-row aggregate table but attached the whole 240-row customer export to a personal workspace. The first step is to identify that exact attachment and account, not to run more prompts asking ChatGPT what it saw. The team then checks settings and any sharing, removes access where appropriate, preserves the incident record and follows the agreed notification route. A separate first-day response guide for accidental uploads covers the operational sequence in more detail.

Finally, turn the lesson into a repeatable gate: an approved task list, a no-upload category list, a workspace check, a redaction review and a named human sign-off. Review the gate when the client changes scope, when a new app is connected or when vendor terms change. The safe answer to "can consultants use ChatGPT?" is a documented yes for a specific data category and purpose, or a clear no for that category until the conditions are met.

Questions consultants ask before uploading client material

Does switching off model training make a client upload NDA-compliant?

No. That setting addresses one use of data by the provider. An NDA may separately restrict disclosure to a third party, permitted purposes, subcontractors, retention and onward sharing. Read the agreement and any client AI policy first. If permission is unclear, use invented or properly aggregated information until the client approves the proposed workflow in writing.

Is replacing the client's name with Client A enough?

Usually not. A combination of dates, exact revenue, a distinctive incident and a small team can identify the client or individuals even without names. Replace direct identifiers, generalise rare details, and test whether someone familiar with the engagement could reconstruct the identity. Keep the mapping between tokens and real values outside ChatGPT.

Can I connect a client drive to ChatGPT Business instead of uploading files?

Only after reviewing the client's permission, the selected app's access scope and its own terms. A connection can make many documents available through existing account permissions. Limit access to the smallest approved folder or account, check what the app may read or do, and disable the connection when the authorised work ends.

What if a colleague has already pasted confidential material?

Stop further uploads and preserve the facts: which account and workspace were used, the exact material, time, connected apps and any sharing. Tell the engagement lead promptly, follow the agreed incident route and seek legal or privacy advice where required. Deleting a chat can be appropriate, but it does not by itself establish that every contractual or notification obligation has been met.

Further reads

• Is It Safe to Put Customer Data Into ChatGPT? — Start with the general customer-data risk test.
• Does ChatGPT Train on Client Data? Business vs Free Plans — Compare training defaults across plan types.
• Claude vs ChatGPT for Consultants: Which to Pay For and How to Test Both — Compare the assistants on a client task.
• AI Consulting Contracts: 9 Clauses to Check Before You Sign — Check wider supplier and deliverable clauses.
• How Should Consultants Use AI? A Client-Data Checklist — Apply the wider client-data checklist to every AI tool.
• ChatGPT Custom Instructions for Consultants: Setup and Data Rules — A ready-to-adapt custom-instructions set-up for consultants, how Projects hold client context, and a plain never-paste list for client data.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI help articles, Data controls in ChatGPT; Managing data, sharing, and privacy in ChatGPT Business; Connected apps in ChatGPT; OpenAI, Enterprise privacy at OpenAI (Data Processing Addendum and retention FAQs). Checked 4 November 2026.