AI and privacy
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
The whole file is sent to the provider, stored and read there so the model can answer questions about it. It remains until you delete it or a retention policy clears it. On a personal subscription, its contents may be used to improve models, depending on settings. On a business subscription, that does not happen by default.
This article explores one question; the full overview is on AI chatbots and the GDPR.
Below is what the providers themselves say about each aspect, as of October 2026. This documentation changes regularly: check the linked pages before basing a decision on it. Why a client file in a chat window creates GDPR concerns is explained on ChatGPT, Claude, Mistral Vibe and the GDPR.
A chatbot does not read a file on your own computer. It is uploaded to the provider's servers, where text is extracted for the model. In its explanation of uploading files and audio to ChatGPT, OpenAI says most subscriptions extract digital text from a file. According to that page, a document may be up to 512 MB: an entire client file fits in one upload.
As an example of what you can do with a file, OpenAI mentions requesting metadata, such as author or creation date. Those therefore go along too. The same applies to unseen contents: margin comments, tracked changes, hidden columns and the text layer beneath a blacked-out passage.
In ChatGPT, a file may sit in four places. Its location determines what deletion means. The table follows OpenAI's page on chat and file retention, as of October 2026.
| Location | What it is | Remains until | What you need to know |
|---|---|---|---|
| In a conversation | An attachment to one chat | You delete the chat or a workspace retention policy clears it | Content extracted into the conversation remains in that conversation |
| In the library | A stored copy separate from the conversation | You delete the file itself from the library | Deleting a chat does not remove this copy |
| In a project | A file belonging to a project, including a shared project | The project or file is deleted | Anyone with project access works with the file |
| In a custom GPT | A GPT's knowledge file | The GPT is deleted | Remains while the GPT exists, even if everyone forgets it |
After deletion, OpenAI schedules permanent deletion within thirty days unless longer retention is needed for security or a legal obligation.
None of the three providers automatically clears files for personal subscribers. The period starts when someone deletes them.
Ordinary conversations remain until you delete them or a workspace retention policy clears them. Files in libraries, projects and GPTs follow the table above. For Enterprise, OpenAI mentions temporary files that may expire after 48 hours and backups that may contain a deleted file for up to thirty more days.
OpenAI may retain a copy of a temporary chat for up to thirty days for security. A file in a temporary chat therefore also goes to the provider first.
Anthropic's privacy centre gives no separate period for uploaded files. Its retention periods page concerns conversations: a deleted conversation disappears from Anthropic's systems within thirty days. We assume an attachment follows the conversation, but the text does not explicitly say so. Ask if it matters to your decision.
Anthropic does name two exceptions. If a Free, Pro or Max user permits conversations to improve the model, data may remain in the training environment for up to five years, dissociated from the user. A conversation flagged by safety systems may be kept for up to two years.
For business customers, the same thirty days after deletion applies. Custom retention periods are an Enterprise feature.
Mistral, which now calls its assistant Mistral Vibe, gives no fixed period for conversations and files in its help centre. The retention periods page only says data is retained while processed. For the precise period, check the privacy policy and agreement.
For its business services, OpenAI explains access on Enterprise privacy. All business data may pass through automated safety systems. Human access for ChatGPT Business is limited to authorised staff for support, investigating abuse and legal obligations, and external parties assessing abuse under confidentiality obligations. Those commitments do not apply to personal subscriptions.
With a personal account, the organisation cannot access anything. If a client asks what data was shared, you cannot check.
On a business subscription, ChatGPT Business workspace administrators may view, export and delete conversations. A file in a shared project is available to everyone with project access, including people who may not see the original in your records system. The same question arises with assistants searching your own files; see Microsoft 365 Copilot and the GDPR: what can Copilot see in your SharePoint?.
An assistant may call a search engine or connected app along the way. In its explanation of data residency, OpenAI says anything sent to such a service falls under that party's terms, and PDF text extraction may take place outside the chosen region.
The answer depends on the subscription, not the file type. An attachment is input, just like a typed question.
What each subscription arranges is explained in detail in ChatGPT Free, Plus, Business or Enterprise: which subscription may you use for business?.
In ChatGPT and Claude, a thumbs up or down on a personal subscription may make the whole conversation available for model improvement even with training disabled. Giving a useful answer about a client file a thumbs up shares more than you think.
A deleted chat disappears from your overview immediately. Permanent deletion follows within thirty days at OpenAI and Anthropic, with exceptions for security and legal obligations. In ChatGPT, delete the library copy, project file and GPT knowledge file separately.
OpenAI makes an exception on deletion for content already dissociated from your account. None of the providers promises that something already included in training is removed on request. The moment to choose is before uploading.
Under Article 17 GDPR, the client the file concerns has a right to erasure in certain cases and directs that request to you. If the file is on an employee's personal account, you cannot carry it out.
A typed question contains what the employee consciously writes. A file contains everything.
The Autoriteit Persoonsgegevens mentions summarising large files in its warning about AI chatbot data breaches. One notification concerned a file with telecommunications clients' addresses. See also Data breach through an AI chatbot: when must you notify the AP?.
There are four. They are not mutually exclusive: many organisations use two alongside one another.
| Approach | What reaches the AI provider | What you must arrange | Where it falls short |
|---|---|---|---|
| Do not upload | Nothing from the file | A clear rule and working alternative | Without an alternative, use goes underground |
| Anonymise it yourself first | An edited copy | Time, a process and a second reader | Manual work always misses something; true anonymity is rarely achievable |
| Business subscription with an agreement | The full file | Data processing agreement, transfer basis, record, often a DPIA | Everything still goes along; nobody checks contents beforehand |
| Pseudonymise before AI | Only passages with pseudonyms | An intermediary layer detecting, replacing and enabling review | It remains personal data for you; detection is never complete |
The simplest rule, and the only right one for some files. It works only if there is another way to do the work.
Removing names and numbers reduces risk but does not automatically make text anonymous, and takes time for each document. See Pseudonymisation or anonymisation: the difference and why it matters for AI.
This arranges the relationship with the provider; see Data processing agreement with OpenAI, Anthropic, Microsoft or Mistral: what should you check?. It does not change what is sent: the entire file goes along.
Here the file does not go to the AI provider. An intermediary replaces personal data with pseudonyms and gives the assistant only passages relevant to a question. How that works is in What is an MCP server?.
PrivaSearch implements the fourth approach. It sits between your documents and the AI model. Upload files to PrivaSearch or connect a SharePoint library, which is only read. The document does not go to an AI assistant's provider.
Within PrivaSearch, names, addresses, BSNs, IBANs, vehicle registration numbers and dates of birth are detected without an external AI provider and replaced with pseudonyms consistent within a project. A colleague then sees original and pseudonymised text side by side, adds what is missing and approves. Without approval, a document is not searchable; detection is never complete. See How PrivaSearch works.
An AI assistant can search released text through an MCP connection. This works with Claude, ChatGPT Business and Mistral Vibe. For each question, the assistant receives a limited number of pseudonymised passages with a source reference, and no file, filename or link. Actions are logged.
What the assistant receives falls under its provider's retention policy; anything you type goes there directly. Pseudonymised data remains personal data for your organisation. You set an end date per project; see retention periods and Hosting in the EU.
To see it with your own example file, book a demo.
A PDF without personal data or confidential information presents little risk. With a client file, the entire file is stored at OpenAI, including metadata. On a personal subscription, content may be used to train models until you disable that, and there is no data processing agreement. That is not a suitable place for client data.
Until you delete it or your workspace's retention policy clears it. OpenAI then schedules permanent deletion within thirty days, with exceptions. Note the location: a library file remains when you delete the chat, and a project file stays until the project or file is removed.
You can delete the file and conversation, after which it disappears from the provider's systems within its deadline. Providers do not promise removal of content already used to improve a model. If training was disabled or you use a business subscription, that question does not arise. Choose before uploading, not afterwards.
Not by default. OpenAI says business data passes through automated safety systems and human access is limited to authorised staff for support, abuse investigation and legal obligations. Anthropic may retain a conversation flagged by safety systems longer. Human viewing is therefore not excluded. For a sensitive file, that is a reason not to share it in full.
No. An image is likewise sent to the provider and stored there. A screenshot often contains more than intended: a name in the title bar, another file in the background. Format makes no difference to the GDPR. What matters is the personal data shown.
Uploading sends a copy of the entire file to the chatbot provider. Searching through a connection keeps the file where it is and retrieves only relevant passages per question. What the assistant sees depends on the connection. If it passes raw text, personal data still goes along. If it passes pseudonymised passages, it does not.
How schools use AI, why pupil data receives extra protection, which applications are prohibited or high risk, and what a school needs to arrange.
What ChatGPT stores, who can access it, how to turn off training, and what temporary chats, memory and shared links do. Includes a practical checklist.
Claude, Microsoft Copilot, Gemini and Mistral Vibe alongside ChatGPT Business: training, agreements, data location and administration. October 2026.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →