# Is It Safe to Paste Client Emails into ChatGPT? > Is it safe to put client data in ChatGPT? A practical checklist: what to remove first, which plan settings to check, and the rules your industry points to. Source: https://learn.ynteractive.com/content/blog/is-it-safe-to-paste-client-data-into-chatgpt · Updated 2026-10-01 · Free from Stepthrough (https://learn.ynteractive.com) By [Robert Breen](https://learn.ynteractive.com/content/about) · Published October 1, 2026 · Updated October 1, 2026 · 6 min read ChatGPT · Privacy Pasting client emails into ChatGPT can be safe if you remove every private detail the task doesn't need, use a plan that doesn't train on your chats, and follow your company's AI policy. This checklist is for office staff at accounting firms, insurance agencies, law firms and HR teams, and you can practice it free in the [tax firm reply lesson](https://learn.ynteractive.com/content/chatgpt-reply-client-refund-emails-accounting) without touching a real account. A client email is sitting in your inbox. ChatGPT could draft a good reply in a minute, but there's an account number in the second message and a date of birth in the signature. That hesitation is healthy. The steps below turn it into a routine. This is general guidance, not legal advice: your company's policy and your professional rules come first. ## What should I paste into ChatGPT, and what should I leave out? Paste only what the reply needs, and leave out everything else. To answer "where's my refund?", ChatGPT needs to know which forms are in and what the firm can promise, not the client's Social Security number. In every Stepthrough reply lesson, the copy step comes with the same instruction: select the messages, and if there's anything private in there, leave it out. A short numbered facts list helps too. When you write the facts yourself, you choose exactly what ChatGPT sees, which is safer and gives a better draft. ## What client data should each industry remove before pasting? Each industry lesson's guide names what to take out and which rules to check. Here is what each one says. IndustryRemove before pastingWhat the guide points toTax and bookkeepingSocial Security numbers, bank routing and account numbers, dates of birth, anything the reply doesn't needYour firm's written data-security plan; IRS Publication 4557, Safeguarding Taxpayer DataInsurance agenciesDriver's license numbers, dates of birth, Social Security numbers, bank details, medical information from any injury claimYour agency's written information security program; the Gramm-Leach-Bliley Act and state laws based on the NAIC model lawLaw firmsAnything the reply doesn't need from a confidential client emailYour firm's AI policy and your jurisdiction's rules; ABA Formal Opinion 512 (July 2024)Recruiting and HRAnything the scorecard doesn't need; nothing that isn't job-relatedYour company's policy - **Accounting:** IRS Publication 4557 is a good reference if your firm is writing its data-security plan. More in [ChatGPT for accountants](https://learn.ynteractive.com/content/blog/chatgpt-for-accountants). - **Insurance:** insurance agencies are covered by privacy rules under the Gramm-Leach-Bliley Act, and many states have adopted insurance data security laws based on the NAIC model law. See [ChatGPT for insurance agencies](https://learn.ynteractive.com/content/blog/chatgpt-for-insurance-agencies). - **Law:** ABA Formal Opinion 512 says lawyers need to understand how a tool uses what they enter, and that informed client consent may be needed before client information goes into a tool that can learn from it. See [ChatGPT for law firms](https://learn.ynteractive.com/content/blog/chatgpt-for-law-firms). - **Recruiting:** interview notes are personal information about the candidate, so keep them only where your policy says. See [ChatGPT for recruiters](https://learn.ynteractive.com/content/blog/chatgpt-for-recruiters). ## Does ChatGPT train on the client data I paste? It depends on your plan. On ChatGPT Business and Enterprise, OpenAI says it does not train on your chats by default; on personal plans, you can turn off "Improve the model for everyone" in **Settings**, under **Data controls**. Check that setting before the first real client thread, not after. If your company provides a business plan, use that account for work rather than a personal one. A plan that doesn't train on your chats is still a place you've sent the data. Removing what isn't needed still matters on every plan. ## Do I need my company's permission to use ChatGPT with client data? Yes: follow your company's written AI policy first, and fit AI use inside any data-security program you're already bound by. Every Stepthrough industry lesson says some version of this. Before you paste, check: - Does your company, firm or agency have a written AI policy? Some allow AI on approved accounts only, some not at all. - Does your industry require a written data-security or information security program? AI use should fit inside it. - In law, does the matter need client consent before information goes into the tool? ## Try it free, step by step **Reply Faster to Clients Chasing Their Refund: ChatGPT for Tax and Bookkeeping Firms**. A client wants a refund date while two tax forms are still missing. Give ChatGPT the thread and your firm's facts, catch the date it shouldn't promise, and send a calm, clear reply from Gmail. You do every step yourself in a practice copy of ChatGPT, it checks your work as you go, and “Do it for me” finishes any step you get stuck on. Free, and nothing touches your real accounts. [Start the free lesson](https://learn.ynteractive.com/modules/accounting-reply-faster) [Or read the full step-by-step guide](https://learn.ynteractive.com/content/chatgpt-reply-client-refund-emails-accounting) ## How do I keep sensitive data out of the reply ChatGPT writes? Put the rule in your facts list, and ChatGPT repeats it in every draft. Privacy covers what leaves your outbox, not only what goes into ChatGPT. - In the [tax firm reply](https://learn.ynteractive.com/content/chatgpt-reply-client-refund-emails-accounting), the client offers to email his new bank account numbers. Fact 6 says never send account numbers by email: add them in the portal under **Refund details**. - In the [law firm reply](https://learn.ynteractive.com/content/chatgpt-client-case-update-email-law-firm), the client wants to text screenshots of evidence. The firm's rule is no case details or evidence by text or social media, only the [secure client portal](https://learn.ynteractive.com/content/glossary/client-portal) under **Documents**. - In the [interview scorecard](https://learn.ynteractive.com/content/chatgpt-interview-debrief-scorecard), the [follow-up email](https://learn.ynteractive.com/content/glossary/follow-up-email) to the candidate includes only the next steps. The scores, the panel's discussion and the pay question stay inside the team. The scorecard request also tells ChatGPT to use only what's in the transcript and about the must-haves, with no guessing at age, family, health, religion or anything else that isn't job-related. When a panelist mentions the candidate's kids, the comment never makes it into the scorecard. ## Should a person read every AI-drafted client email before it's sent? Yes. A person should read every reply, because AI drafts lean toward reassuring promises the facts don't support. In the [insurance claim lesson](https://learn.ynteractive.com/content/chatgpt-reply-claim-status-emails-insurance-agency), the first draft promises a rental "the whole time your CR-V is in the shop" and says the rate "won't go up." Neither promise is in the facts, and a claim-by-claim check catches both. More in [check AI drafts for promises](https://learn.ynteractive.com/content/blog/check-ai-drafts-for-promises). ## Can I practice this without real client data? Yes. The Stepthrough lessons run on practice copies of Gmail, Google Docs and ChatGPT with made-up businesses, including Harbor Street Law and Willow Bend Physical Therapy, and nothing you type is sent anywhere. ## Key takeaways - Before pasting a client email into ChatGPT, remove Social Security numbers, account numbers, dates of birth, license numbers, medical details and anything else the task doesn't need. - On ChatGPT Business and Enterprise, OpenAI says it does not train on your chats by default; personal plans can turn off "Improve the model for everyone" under Settings, [Data controls](https://learn.ynteractive.com/content/glossary/chatgpt-data-controls). - Your company's AI policy and your industry's rules, such as IRS Publication 4557, the Gramm-Leach-Bliley Act or ABA Formal Opinion 512, come before any plan setting. - Put rules like "never send account numbers by email" in your facts list so every ChatGPT draft repeats them. - A person should read every AI-drafted client reply before it is sent. ## Frequently asked questions **Is it safe to paste client emails into ChatGPT?** It can be, after you remove anything the reply doesn't need and only in line with your company's policy and professional rules. Business and Enterprise plans don't train on your chats by default, and personal plans can turn training off under Data controls. **Does ChatGPT train on what I paste?** On ChatGPT Business and Enterprise, OpenAI says it does not train on your chats by default. On personal plans you can turn off "Improve the model for everyone" in Settings under Data controls. **What should I remove before pasting a client email into ChatGPT?** Remove Social Security numbers, bank and account numbers, dates of birth, driver's license numbers, medical details and anything else the task doesn't need. Write the facts the reply needs as a short numbered list instead. **Do lawyers need client consent to use ChatGPT?** ABA Formal Opinion 512 (July 2024) says informed client consent may be needed before client information goes into a tool that can learn from it. Check your jurisdiction's rules and your firm's AI policy; this isn't legal advice. ## Free lessons in this post - [Reply Faster to Clients Chasing Their Refund: ChatGPT for Tax and Bookkeeping Firms](https://learn.ynteractive.com/content/chatgpt-reply-client-refund-emails-accounting): A client wants a refund date while two tax forms are still missing. Give ChatGPT the thread and your firm's facts, catch the date it shouldn't promise, and send a calm… - [Reply Faster to Claim-Status Emails: ChatGPT for Independent Insurance Agencies](https://learn.ynteractive.com/content/chatgpt-reply-claim-status-emails-insurance-agency): A client with an open auto claim wants a payment date, a rental and a promise about her rate. Give ChatGPT the thread and your agency's facts, catch what it shouldn't… - [Reply Faster to a Client Asking for a Case Update: ChatGPT for Small Law Firms](https://learn.ynteractive.com/content/chatgpt-client-case-update-email-law-firm): A client wants a court date and a promise she'll win. Give ChatGPT the thread and your firm's facts, catch the lines that predict an outcome, and send a clear, kind… - [Turn an Interview Debrief into a Scorecard and a Candidate Follow-Up (Recruiting & HR)](https://learn.ynteractive.com/content/chatgpt-interview-debrief-scorecard): Turn the transcript of an interview panel's debrief into a scorecard against the role's must-haves, the decisions, action items with owners and dates, and a follow-up… ## Related terms Plain-English definitions, each with an example from a free lesson. [Client portal](https://learn.ynteractive.com/content/glossary/client-portal) · [Follow-up email](https://learn.ynteractive.com/content/glossary/follow-up-email) · [ChatGPT data controls](https://learn.ynteractive.com/content/glossary/chatgpt-data-controls) · [Action items](https://learn.ynteractive.com/content/glossary/action-items) · [AI acceptable use policy](https://learn.ynteractive.com/content/glossary/ai-acceptable-use-policy) · [AI bias](https://learn.ynteractive.com/content/glossary/ai-bias) · [AI summarization](https://learn.ynteractive.com/content/glossary/ai-summarization) · [Candidate experience](https://learn.ynteractive.com/content/glossary/candidate-experience) [The full AI glossary](https://learn.ynteractive.com/content/glossary) ## Related prompts - [Action items table prompt](https://learn.ynteractive.com/content/prompts/action-items-table-prompt): Paste a meeting transcript or rough notes and get a table of every task, owner and due date, with "Not stated" wherever nobody… - [Annual coverage review invite prompt](https://learn.ynteractive.com/content/prompts/annual-coverage-review-invite-prompt): Invite an insurance client to a short annual review: why now, what to have handy, two times to pick from. No scare tactics and… - [Candidate follow-up after interview prompt](https://learn.ynteractive.com/content/prompts/candidate-follow-up-after-interview-prompt): Write the email a candidate gets after an interview: thanks, where things stand, the next step and when they'll hear back, with… - [Candidate pipeline update prompt](https://learn.ynteractive.com/content/prompts/candidate-pipeline-update-prompt): Turn an applicant tracker export into a weekly hiring update: counts by stage, what moved, next steps with owners, stalled… [All free prompt templates](https://learn.ynteractive.com/content/prompts) ## Visual guides The same ideas as quick visual guides: swipe through the slides, or read each one as text. - [5 Steps to Answer a Claim-Status Email Without Overpromising](https://learn.ynteractive.com/content/visual/5-steps-claim-status-email-reply): A visual guide for insurance agencies: answer a client's claim-status email with ChatGPT, then check every claim against your facts before you send. - [5 Steps to Turn an Interview Debrief into a Scorecard](https://learn.ynteractive.com/content/visual/5-steps-interview-debrief-to-scorecard): A visual guide: turn an interview panel's debrief transcript into a ChatGPT scorecard with evidence for each must-have, then a candidate follow-up. - [Myth: A Business ChatGPT Plan Makes PII Safe to Paste](https://learn.ynteractive.com/content/visual/myth-business-plan-makes-pii-safe): Myth vs fact: a business plan can reduce risk, but it doesn't override industry rules or client agreements. Leave out what the task doesn't need. [All visual guides](https://learn.ynteractive.com/content/visual) ## Keep reading - [Check AI Email Drafts for Promises Before You Send](https://learn.ynteractive.com/content/blog/check-ai-drafts-for-promises): Check a ChatGPT email before sending: ask for a table of every promise in the draft and the numbered fact behind it. Three real examples and a prompt. - [ChatGPT for Paralegals: Client Updates and Case Recaps](https://learn.ynteractive.com/content/blog/chatgpt-for-paralegals): ChatGPT for paralegals and legal assistants: draft client updates from a facts list with no predictions, recap case meetings, and know what never to paste. - [Interview Debrief Template: Run It Fair, Then Score It](https://learn.ynteractive.com/content/blog/interview-debrief-template): An interview debrief template for small teams: a must-have-by-must-have agenda, how to park off-topic comments, and a ChatGPT prompt for the scorecard. [All blog posts](https://learn.ynteractive.com/content/blog) · [All free tutorials](https://learn.ynteractive.com/content)