Can you put client data into ChatGPT?
It depends on your account type, your contract with the client and the duties that apply to you. The simple way to lower the risk is to remove PII and identifying details before sending.
What happens to the text
That depends on the plan. Under OpenAI's policy, conversations on personal plans (Free and Plus) may be used to train its models by default, and you can turn that off in settings. Business plans and the API aren't used for training by default. Either way, the text leaves your organisation for an outside provider, so check your plan's terms and where the data is held.
What Amendment 13 changes
Amendment 13 to Israel's Protection of Privacy Law took effect on 14 August 2025 and strengthened enforcement. According to reviews of the amendment, anyone passing personal data to a provider should review that provider, sign a suitable agreement and monitor compliance. Some organisations must also appoint a data protection officer. So even one pasted client email can be a compliance question, not just a matter of convenience.
Some professions, such as lawyers and doctors, often have a separate duty of confidentiality too.
Deleting the name isn't enough
A description can identify someone without a name. "The only doctor in a small kibbutz in the Arava" points to one person. Here is that text before and after Ploni, with invented details:
An interviewee described by role, place and history, with no name given.
What to do
- Set a policy: which AI tools your organisation allows, and for which kinds of data.
- Check your plan: training, retention and where the provider holds the data.
- Remove identifiers before sending: descriptions that identify as well as names and numbers.
- Review sensitive texts: an automated tool can miss details, even a good one.
- Ask your adviser: when in doubt, or for medical or legal material.
General information only, not legal advice. Sources: OpenAI data policy, IAPP review of Amendment 13.