Data privacy when using AI tools

When you ask an AI assistant to summarize a contract, review a spreadsheet or reply to a client, the text and attachments are sent to the provider’s servers. There they are processed to generate the answer and, depending on the plan and settings, may be stored, reviewed by people or used to train new models.

This article explains what happens to that data, which controls the main services offer (according to the official pages consulted on October 8, 2026), what Brazilian law says and which habits reduce the risk. Policies change often; always check the current version before deciding.

What happens to what you type

What you send to an assistant is called a prompt: the instruction, the question and any attached files. The ANPD (Brazil’s national data protection authority) draws attention to exactly this point. In its study on generative AI in the Radar Tecnológico series, from November 2024, the authority notes that users may attach entire documents, such as confidential business documents, prescriptions and medical reports, deeds and meeting minutes (ANPD, Radar Tecnológico No. 3).

Once sent, that content has four possible destinations:

• Immediate processing: the model reads the request and generates the answer. This always happens.
• History: the conversation is saved in your account so you can come back to it.
• Retention for safety: the provider keeps a copy for a period to investigate abuse, even when you delete your history.
• Model improvement: the content goes into datasets used to train or fine-tune future versions. In some services, a sample is read by human reviewers.

The last two are the most concerning, because they take the data out of your control for longer and put it in front of other people or systems.

Why this is a real risk

The generative AI risk profile from NIST, the U.S. standards institute, describes three privacy problems (NIST AI 600-1, 2024):

• Memorization: models can reproduce fragments of their training data. The document notes that, in deliberate attacks, LLMs have revealed sensitive information present in training data, even when that data appeared only a few times.
• Inference: the model can deduce sensitive data about a person by combining information from different sources, even if no one provided it. And the inference can be wrong, which also causes harm.
• Lack of transparency: most developers do not disclose their specific training sources, so it is hard to know whether personal data was used and how it was collected.

OWASP, a reference community in software security, ranks sensitive information disclosure second on its 2025 list of risks for LLM applications. The risk covers personal data, financial and health records, confidential business information and access credentials (OWASP LLM02:2025). Its recommendations include masking sensitive data, limiting access to the minimum necessary and instructing users not to enter sensitive information.

There is also the risk common to any cloud service: a security breach, a hacked account, history exposed on a shared computer.

What the main services say

The summaries below reflect the official pages on the date they were consulted. They are meant to show what kinds of controls exist, not to judge which service is best.

ChatGPT (OpenAI). For consumer services such as ChatGPT and Codex, OpenAI says it may use content to train models. To opt out, you turn off Improve the model for everyone under Settings > Data controls, or submit a Do not train on my content request in the privacy portal. Even with the option off, if you rate a response (thumbs up or down), the entire associated conversation may be used for training. For the Business, Enterprise and Edu plans and the API, the company says it does not use inputs and outputs for training by default (OpenAI, How your data is used to improve model performance). A temporary chat does not appear in history and is not used for training while it remains temporary; if you save it, it follows your account settings (OpenAI, Temporary chat in ChatGPT).

Claude (Anthropic). In August 2025, Anthropic began asking users of its Free, Pro and Max plans to choose whether their conversations can be used to improve its models. According to the announcement, those who allow it have their data retained for up to five years; those who do not keep the 30-day retention. The change does not apply to services under commercial terms (Team and Enterprise plans, government, education and the API) (Anthropic, Updates to Consumer Terms and Privacy Policy).

Gemini (Google). The Gemini privacy hub states that a portion of conversations is read by human reviewers, including trained service providers, and that reviewed conversations are kept for up to three years. The page itself advises against entering confidential information you would not want a reviewer to see. With Keep Activity turned off, new conversations do not feed training (unless you submit feedback), but are still saved for 72 hours (Google, Gemini Apps Privacy Hub).

Three patterns show up in all three cases. First, the control exists, but it is up to you to use it. Second, turning off training does not mean deleting everything: there is always some retention period. Third, giving feedback on a response can reopen the use of the conversation.

Personal account or company account

The difference between individual and business plans is the most important one for anyone working with client data.

On business plans and APIs, the providers above exclude training use by default and offer contracts, admin controls and, in some cases, a choice of processing region. This does not eliminate retention for safety, nor does it remove the need to review the contract. But it changes the legal position: the company now has a formal agreement on what the provider may do with the data.

Using a free personal account for work involving client data is the highest-risk scenario. Settings depend on each employee, there is no contract between the company and the provider, and no one knows what was sent. If your company has not yet defined which tools are allowed, the guide on how to choose an AI platform for your company sets out the criteria.

What the LGPD has to do with it

Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018) defines personal data as any information relating to an identified or identifiable natural person. Sensitive personal data includes, among others, health data, racial or ethnic origin, religious belief, political opinion and genetic or biometric data (Planalto, LGPD, art. 5).

Pasting a client’s name, CPF (Brazil’s individual taxpayer ID) or history into an AI assistant is processing of personal data. Three practical consequences:

• The controller decides. The law calls the party that makes decisions about processing the controller, and the party that processes data on its behalf the processor. If your company uses an AI service with client data, it is responsible as the controller, and the provider generally acts as a processor, which must follow the instructions it receives (art. 39).
• Only what is necessary. The necessity principle limits processing to the minimum required for the purpose (art. 6, III). If the task is to review the tone of an email, the client’s CPF does not need to go along.
• Security is mandatory. Processing agents must adopt technical and administrative measures to protect data against unauthorized access and other incidents (art. 46). Sending data to an unapproved tool, without a contract, is unlikely to meet this requirement.

Because most of these services process data outside Brazil, the rule on international transfer also applies: it is only allowed in the cases listed in art. 33, such as countries with adequate protection or contractual safeguards. This point should be reviewed by the company’s legal team or data protection officer.

The ANPD study takes the same line. The authority notes that clear information on how prompt data is processed is often missing, and considers that shifting all responsibility for data protection onto the user does not seem sufficient to deal with the consequences of this sharing (ANPD, Radar Tecnológico No. 3). The document itself warns that it was written as an internal study in 2023 and may not reflect the most recent updates.

Habits that reduce the risk

For personal use:

1. Review the privacy settings of each assistant you use and make a conscious decision about training use.
2. Use temporary mode when the subject is sensitive, knowing there is still retention for a period.
3. Think before rating a response that contains personal data.
4. Do not paste passwords, API keys, card numbers or identity documents. No ordinary task requires it.
5. Protect your account with a strong password and two-step verification, and delete old conversations you do not need to keep.

For professional use:

1. Use only tools approved by your company, in a corporate account with a contract.
2. Anonymize or replace data before sending: swap names for “Client A”, remove CPF, address and phone number. The LGPD defines anonymized data as data whose subject cannot be identified using reasonable technical means; changing only the name is not always enough.
3. Do not send sensitive data (health, biometrics, beliefs) without prior review by legal or the data protection officer.
4. Be wary of full attachments. Send only the excerpt the task needs.
5. Keep a record of use. The LGPD requires controllers and processors to keep records of processing operations (art. 37), and knowing which data went to which tool helps respond to incidents and to requests from data subjects.

If the company is going to build its own system that queries internal documents, the risks take a different shape. The article on how to build a chatbot with your own documents covers access control in that scenario.

Key takeaways

• What you type or attach in an AI assistant is sent to another company, which may store it, review it and, on some plans, use it for training.
• The controls exist, but they have to be switched on, and turning off training does not remove retention for safety.
• In a professional context, use corporate accounts with a contract, send the minimum necessary and treat every prompt containing other people’s data as personal data processing under the LGPD.