Thursday afternoon in the compilation practice. A junior accountant has exported a client's general ledger and sees a run of postings on the suspense account that fit nowhere. He opens ChatGPT, types "what probably happened here?" and pastes four hundred lines. In them: the client's name, the IBANs of suppliers and customers, the payroll journal with salaries, and in one description a citizen service number someone once typed in for a wage garnishment.
The rule of thumb is short: the task is fine, the client is not. Having a run of entries explained, rewriting the notes, tidying a client email, all of that can be done with a chatbot. What has to come out before you paste is everything that points to the client: the name, the Chamber of Commerce number, the IBANs, the salaries and citizen service numbers, and figures not yet adopted. Whether it is allowed on this account at all depends on what the firm has decided about the tool.
Why is a prompt different from a question to the colleague next to you?
A question to the colleague next to you stays inside the firm, under the same duty of confidentiality you have. A prompt goes to a vendor. What happens to it then depends on the account. On a free or personal account the input can be stored and used to improve the model unless you have switched that off yourself, and there is no data processing agreement underneath. On a firm account with an agreement, different terms apply, and the firm knows them. What happens to a prompt per type of ChatGPT account is in ChatGPT and work data.
Two frameworks meet here. Confidentiality is one of the fundamental principles in the VGBA, the Dutch professional rules for accountants, and that duty covers everything a client entrusts to the firm, including figures with no person in them. Once there is a person in it, the director-shareholder or an employee in the payroll journal, the GDPR applies and a prompt is processing, not a notepad. The Dutch data protection authority reported several data breach notifications in which employees had put personal data into an AI chatbot. The general list of what never belongs in a prompt is in what you can and cannot share with AI. This piece is about the three tasks that come up most often in a firm.
Three tasks, and what comes out
| Task | What stays in | What comes out before you paste |
|---|---|---|
| Explain ledger entries | The accounts, the dates, the amounts, the patterns | The client name, the counterparties and their IBANs, the payroll lines, anything in a description that points to a person |
| Rewrite the notes to the financial statements | The structure of the notes, the accounting policies, the wording | The company name, the amounts, events after the balance sheet date that are not yet public |
| Tidy a client email or advisory memo | The question, the structure, the tone | Name, family relationships, valuations, tax positions, health as the reason for a transfer |
The first row is the awkward one, because a ledger looks harmless. It is numbers. But the descriptions are free text, and after ten years of bookkeeping they hold all sorts: names, number plates, a citizen service number next to a wage garnishment. Paste the ledger and you paste that column with it.
Why is removing the client name not enough?
Because a client is often recognisable by its figures. Revenue of 2.4 million with one customer supplying sixty percent of it points to one company in a small sector for anyone who knows the sector. A Chamber of Commerce number is public and leads straight back. A counterparty with a recognisable name in the descriptions does the same. And in a family business, "the daughter taking over the firm" with the town attached is already a person. Why combinations of innocent fields point to someone is in why "just remove the names" is not enough.
For the ledger that means: not only the name column, but the descriptions and the counterparties too. For the notes: round or replace amounts, and put the figures back yourself after the rewrite. More techniques for cleaning a prompt without losing the task are in the prompt redaction guide. If it is a PDF, a set of financial statements or a contract, redacting the PDF beforehand is the route.
What does a business account change, and what does it not?
A business environment changes the vendor's terms: input is excluded from training by default, a data processing agreement sits underneath, and the firm manages the settings. That is a real difference, and it is why the account type weighs more than the name of the tool.
Three things do not change. Your duty of confidentiality stays yours; the agreement governs what the vendor may do, not what you may share. Identifiability stays: a client is just as recognisable by its revenue in a business account as in a free one. And the decision stays with the firm: the fact that a business environment exists does not mean every piece of client data may go into it. What the firm agrees about that is in the firm's AI policy.
What if the firm has not decided on the tool yet?
Then the instruction that goes with "no decision yet" applies: public information only, and report the tool to whoever is responsible, usually the compliance officer or IT. That is not a ban and not an approval. It is the honest state of affairs, and it saves you guessing. A policy only works once it reaches you at the moment you open the tool, not in last year's manual.
This is what that can look like. BeeSensible shows the firm's decision when you open an AI tool in the browser, with the approved alternative as the first button, and marks sensitive data such as a citizen service number or an IBAN while you type in the supported apps. You choose what happens to it: mask, remove, or leave it. Nothing is blocked, and what you type is not stored.
