Using ChatGPT, Claude or Gemini at work without breaching the GDPR

Almost every professional firm has someone who, privately, uses ChatGPT or a similar tool to speed up a draft, summarise a long document, or rephrase a letter. It's useful — and very often it's also processing of personal data that nobody consciously decided to do.

The question to ask before pasting a text

It isn't “is this tool secure?” — the provider's security is only half the question. It's “what exactly does this text contain, and who will be reading it on the other end?” A case file with a name, a tax ID, an IBAN is personal data regardless of how trustworthy the provider you're sending it to is: the GDPR cares about what is being processed, not only by whom.

Three practical rules

• Separate the draft from the data. You can almost always get the same result — a rephrased letter, a summary, a reply — working on text with placeholders instead of the real data, and putting them back afterwards.
• Know which key you're actually talking to the provider with. A free personal account and a company API key have different retention and data-use terms: worth knowing beforehand, not discovering afterwards.
• Keep the decision inside the organisation. If using AI on client documents is a common practice, it deserves an explicit choice — which tool, with what data, under what limits — not an informal use nobody is accountable for.

How obscurIA does it

obscurIA's AI chat applies these three rules by design, not by promise. Text is protected before it reaches the provider: ChatGPT, Claude or Gemini only ever receive placeholders, never the real name, tax ID or IBAN. The API key is the customer's own, chosen and connected by them, encrypted on their computer. And when the reply comes back, it can be reread with “Real data” — on the same computer, never on our server — before being saved or copied.

Anyone who'd rather work directly on ChatGPT's, Claude's or Gemini's own site can still use obscurIA just to protect text before pasting it, and to restore the real data in the reply when it comes back: the built-in chat is a convenient extra step, not a mandatory one.