Your data ends up somewhere. Do you know where?
Every time you paste text into ChatGPT, you're sending data to a server in the US. The same goes for Claude and Gemini. The question is: what happens to the data afterwards?
The answer depends on which plan you're using. And this is where many people get it wrong.
Free vs. paid: an important difference
On free plans, AI providers can use your conversations to train their models. That means the text you write could become part of the training data.
On paid business plans, the rules are stricter. OpenAI, Anthropic and Google all promise that business data isn't used for training. They sign data processing agreements. They offer better control over storage and deletion.
The difference isn't small. It's crucial. If you're using the free version for work, you should think twice.
A simple test: Ask yourself whether you'd print out the conversation and put it in a window. If the answer is no, use a business plan.
What you should never share with AI
Regardless of which plan you're on, there's data that doesn't belong in an AI chat:
- National ID numbers. Never. Under any circumstances.
- Health information. Patient records, diagnoses, medication lists.
- Customer data with personal information. Names linked to addresses, purchase history or behavior.
- Passwords and access keys. Sounds obvious, but it happens.
- Confidential business information. Tenders, pricing strategies, unpublished accounts.
Rule of thumb: If you wouldn't send it in a regular email, don't paste it into an AI chat.
GDPR and AI: what do the rules say?
GDPR applies to all processing of personal data. Including when AI does the processing. The Norwegian Data Protection Authority has been clear on this.
Three things you need to have in place:
- Legal basis for processing. You need a reason to use personal data in AI. Consent or legitimate interest are the most common.
- Data processing agreement. If you're on a business plan, the provider will have one ready. Read it.
- Duty to inform. Your customers have the right to know that you use AI to process their data.
It sounds complicated. In practice, it's simpler than you think. Use a business plan. Don't share personal data. Inform your customers.
EU AI Act: the new law
The EU has passed the world's first AI law. It takes effect gradually and affects Norwegian businesses through the EEA Agreement.
For most small businesses, it means little today. The law primarily targets developers of AI systems, not users. But you should know it exists.
The key point: AI used for hiring, credit assessments or public services faces strict requirements. If you use AI for such purposes, you should familiarize yourself with the rules.
For regular business use like email, content and analysis? No additional requirements beyond GDPR.
The Data Protection Authority's guidelines
The Norwegian Data Protection Authority published guidelines for AI use in 2025. The core message: you can use AI, but you must do it responsibly.
They recommend:
- Map your usage. Do you know who in your company uses AI, and for what?
- Create guidelines. A simple list of what's okay and what's not. It doesn't need to be a 50-page document.
- Document your choices. Which tools do you use? What data is sent? Where is it stored?
Half an hour is enough to create basic guidelines. It will save you headaches later.
Local AI models: an alternative
Want to use AI without sending data anywhere? Local models run on your own machine. No internet connection needed. No data leaves the office.
Tools like Ollama let you run AI models for free on a regular Mac or PC. The models aren't as good as ChatGPT or Claude, but they're good enough for many tasks.
Perfect for: sensitive documents, internal analysis, trade secrets.
Not as good for: creative writing, complex coding, tasks that require the very best models.
A middle ground: use local AI for sensitive data and cloud-based AI for everything else. You get the best of both worlds.
What about employee usage?
The biggest privacy risk doesn't come from you. It comes from employees using AI without guidelines. A colleague who pastes a customer list into ChatGPT to sort it. A salesperson who shares confidential pricing information.
It doesn't happen out of malice. It happens because nobody told them they shouldn't. Create guidelines. Provide training. It takes 30 minutes and saves you from potential GDPR fines.
Practical tips for safe usage
Here's a checklist you can use today:
- Use a business plan. 220 NOK/month is cheap insurance. Your data won't be used for training.
- Anonymize data. Replace names with "Customer A". Remove national ID numbers. Use fictitious numbers in examples.
- Create an internal policy. Three points is enough: what's okay, what's not okay, who do you ask if you're unsure.
- Check the settings. All three major AI services let you turn off history storage. Do it for sensitive conversations.
- Stay updated. The rules are changing. Follow the Data Protection Authority's website for news.
Don't let fear stop you
Some businesses avoid AI entirely because of privacy concerns. That's understandable, but unnecessary. With simple measures, you can use AI safely.
Businesses that use AI wisely save time and money. Businesses that avoid it entirely risk falling behind. The solution isn't to say no. It's to say yes, but with sensible guardrails.
Ready to get started?
Get in touch for a no-obligation chat about how AI can help your business.