Is ChatGPT Safe? Data Privacy for Accountants

It depends: ChatGPT can suit client work in an approved business workspace, but personal Free or Plus accounts are unsuitable for client records by default.

Is ChatGPT Safe for Client Information?

ChatGPT is safe enough for a particular task only when your practice approves the account, the information entered and its handling. Paying for Plus does not turn a personal account into a business workspace.

Your decision must cover model training, retention, staff access and storage locations. A secure password protects sign-in. It does not decide whether OpenAI can retain a return or whether your client has authorised that disclosure.

OpenAI’s privacy policy describes disclosures to service providers and business account administrators. Treat uploading a document as sharing it with a provider, even if the conversation is hidden from other ChatGPT users.

For a practice-wide approach, use the AI privacy guidance to decide which information each approved tool can receive.

What OpenAI Does With Your Chats

ChatGPT stores ordinary conversations until you delete them or an applicable workspace retention policy removes them. Personal-account content can also improve models, depending on your settings.

In personal accounts, open Settings > Data controls and switch off “Improve the model for everyone”.

OpenAI’s consumer data guidance explains that authorised people can still access content for support, safety or legal work. Turning training off does not prevent those uses.

Consumer content is stored on OpenAI and service-provider systems in the US and elsewhere. Do not assume an Australian account means Australian storage.

Memory and Temporary Chat

Memory can carry information from one conversation into later answers. Depending on your settings, ChatGPT uses remembered details and past chats to personalise replies. Removing the original conversation does not necessarily clear remembered information.

Review and remove unwanted information through ChatGPT’s memory settings. Turning memory off does not itself delete existing memories.

A Temporary Chat stays out of history unless you save it and is excluded from model improvement while temporary. OpenAI can keep a copy for up to 30 days for safety.

Temporary Chat can use existing memories when personalised. Choose the unpersonalised option before starting when you want to exclude them. It does not create new memories while temporary.

Saving a Temporary Chat converts it into a regular chat subject to your account settings. A GPT action can also send information to another provider with different retention terms.

Deletion Has Limits

OpenAI’s chat and file retention rules schedule deleted saved chats for removal within 30 days. Exceptions include legal or security retention and content already de-identified and separated from your account.

A file saved separately to Library or Space can remain after its chat is deleted. If staff have already entered client records, follow the delete ChatGPT history steps and your practice’s incident procedure.

Tax File Numbers and Client Documents in ChatGPT

Adopt a practice rule that bans TFNs, identity documents and complete tax returns from general ChatGPT conversations. This is a practical information-handling rule, rather than a claim that legislation names ChatGPT as prohibited software.

The Privacy (Tax File Number) Rule 2015 restricts TFN collection, use and disclosure. It also requires reasonable steps to safeguard TFN information. Client permission does not remove those separate obligations.

The Tax Practitioners Board’s AI guidance applies Code item 6 to client information disclosed through AI tools. Unless a legal duty applies, obtain the client’s permission before disclosure to a third party.

Explain the recipient, storage arrangements and proposed AI use when seeking permission. A no-training promise does not replace that permission or your assessment of the provider.

A De-Identified Prompt

Incorrect practice: attach a client’s complete return and ask ChatGPT to find missing deductions. That sends identifiers and financial details together.

Use a fictional prompt instead, for example: “Draft a checklist of evidence an Australian tax agent would request before assessing a work-related travel deduction. Do not determine deductibility.”

For a real case, remove names and identifiers, file metadata and details that identify the client in combination. Replacing a name with “Client A” alone is insufficient.

A Warning You Can Send Clients

Suggested client message:

Please send tax records through our secure document channel. Avoid uploading your TFN, identity documents or full return to a personal AI chatbot.

If you have already uploaded them, tell us which service and account you used and what you shared. We can then discuss the next steps with you.

Keep the message focused on information exposure. Do not treat an AI-prepared return as evidence that the figures or claims are correct.

ChatGPT Business, Enterprise and the API

Business workspace content and API inputs are excluded from model training by default. That improves the starting position for client work, but retention and access still need approval.

Data Terms by Account

Account	Model improvement	Retention and access
Personal Free or Plus	Content can improve models, depending on settings	Ordinary chats remain until deleted; authorised human access remains possible
ChatGPT Business	Excluded by default	Admins can set retention and access workspace conversations; OpenAI permits limited staff and contractor access
ChatGPT Enterprise	Excluded by default	Admins set retention and can use compliance tools; OpenAI restricts employee access to specified purposes
API	Excluded by default	Abuse logs and stored application data have separate retention rules

OpenAI’s enterprise privacy commitments describe these business arrangements. Business admins can view, export and delete workspace conversations. Enterprise provides compliance access, so neither workspace is a private diary hidden from the practice.

The OpenAI Services Agreement governs business use alongside applicable additional terms. Record the agreement and approved workspace settings before allowing a client-data task. The ChatGPT Business guide covers the plan decision in more detail.

The API is a route for software to call OpenAI, with its own data retention rules. Default abuse-monitoring logs can contain prompts and responses for up to 30 days, with specified exceptions.

Stored responses, files and other features can keep data separately. Zero Data Retention requires eligibility and configuration and does not cover every feature. An accounting tool’s own storage also needs assessment, even when it uses the API.

Past OpenAI Breaches and Security Risks

OpenAI has disclosed incidents affecting user information. Their scope differs, so a practice must distinguish exposed conversations from exposed account details.

In its 2023 outage report, OpenAI described a bug exposing some users’ chat titles and potentially a new conversation’s first message. It also potentially exposed limited billing details for 1.2% of Plus subscribers active during a particular nine-hour window.

The affected billing information included contact details and partial card information. Full credit card numbers were not exposed. The percentage described that active group, rather than all ChatGPT users.

OpenAI’s 2025 Mixpanel incident disclosure concerned a supplier’s analytics systems. Exposed fields could include names, email addresses and approximate locations for affected users. OpenAI said chats, API requests and credentials were not exposed.

Those incidents support limiting the information a chatbot receives. They do not establish that every conversation is public. Train staff to recognise phishing after account details leak and require two-step sign-in for approved accounts.

A ChatGPT Rule for Client Work

Give staff a written rule that identifies the permitted workspace and the person responsible for approving client-data tasks. A usable starting policy follows.

1. Use only the practice-approved Business or Enterprise workspace, or an approved API-based service, for authorised client work. Personal accounts receive fictional or genuinely de-identified material only.
2. Keep TFNs, identity documents and complete returns out of general chatbot prompts. Send only the minimum information the approved task needs, after obtaining the required client permission.
3. Turn off consumer model improvement. Disable memory, unapproved apps and external GPT actions for client tasks, and use the practice’s agreed retention settings.
4. Require a suitably qualified practitioner to check facts, calculations and advice before output reaches a client. Keep the reviewed work in the client file.
5. Report accidental uploads immediately to the practice’s privacy lead. Record what was entered, restrict further sharing and assess the incident before relying on deletion as the remedy.

Apply the rule to ChatGPT for accountants tasks such as drafting generic checklists. Before the next client task, confirm staff are in the approved workspace and can explain exactly which information they may enter.