A customer support agent is behind. A complaint has to go out today, the customer is angry and every draft sounds stiffer than the last. She opens ChatGPT on her personal account, pastes the whole email thread in and asks for a warmer reply. An hour later she mentions it to her team lead, who forwards it to the privacy team. The thread contained the customer's name, address, account number and his explanation that he had missed the payment because he had been ill.
The question on the DPO's desk is not whether staff may use AI. It is narrower than that: is this a breach, does the regulator need to hear about it within 72 hours, and what happens now?
When a prompt becomes a personal data breach
The ICO's guide to personal data breaches (Checked 23 October 2026) defines a breach as a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Deliberate or accidental, it makes no difference. Pasting a customer's details into a service the organisation never approved is a disclosure to a party that should not have them.
The Dutch data protection authority, the Autoriteit Persoonsgegevens, applied this directly to AI chatbots in a 2024 warning (in Dutch, checked 23 October 2026). When staff use a chatbot on their own initiative and against their employer's rules, and enter personal data, it is a data breach. When chatbot use is part of the organisation's policy, it is not a breach, though it is often still not lawful. That second case needs a different fix: a lawful basis, terms with the vendor and a decision on which data may go in.
The authority described two of the notifications it had received. At a GP practice, an employee had entered patients' medical data into an AI chatbot against the practice's rules. At a telecom company, an employee had entered a file that included customer addresses. More cases, including some from 2025, are on our page about AI data leakage.
The first hour
Before anyone decides about reporting, get the facts straight while they are still easy to find.
Find out exactly what was pasted. The whole thread or a single paragraph? One customer or a list? Was a file attached? Ask the employee to open the chat and go through it with you before anything is deleted. That chat is your record of what left the building.
Establish which account it was. A personal free account, a paid personal plan, or a business workspace your organisation set up. On a personal account the organisation has no agreement with OpenAI and no access to the chat. The difference is set out in ChatGPT Business vs Plus.
Contain what you can. Once you have recorded what was in the chat, have the employee delete it. According to the OpenAI Help Center (Checked 23 October 2026), a deleted chat disappears from the account at once and is scheduled for permanent deletion from OpenAI's systems within 30 days, unless OpenAI has to keep it longer for security or legal reasons. Deleting limits the exposure. It does not reverse it.
Write down when you found out. The 72 hours run from the moment your organisation becomes aware of the breach, not from the moment the text was pasted.
Does the regulator need to know?
Under Article 33 of the GDPR (Checked 23 October 2026), you notify your supervisory authority unless the breach is unlikely to result in a risk to people's rights and freedoms. The ICO puts it plainly: if a risk is likely, you must report; if it is unlikely, you do not, but you need to be able to justify that decision and should document it. The assessment is yours to make.
For a prompt in ChatGPT, it comes down to four questions.
| Question | Points to a lower risk | Points to a higher risk |
|---|---|---|
| What data? | A name and job title in a business email | Health, criminal records, or details that leave someone exposed |
| How many people? | One customer, a few details | A pasted list, an export, a case file |
| Which account? | A business workspace with agreed vendor terms | A personal account with no agreement |
| Can you reconstruct it? | Chat reviewed, contents recorded, then deleted | Nobody is sure what was in it |
If you report, do it without undue delay and no later than 72 hours after becoming aware. The ICO accepts that you will not always have the full picture by then. Article 33(4) lets you send the details in phases, as long as you do not sit on them.
When to tell the people affected
Article 34 adds a second duty. If the breach is likely to result in a high risk to the individuals, you tell them directly and without undue delay. In the support example only one customer was involved, but the thread included a remark about his illness. That is health data, a special category under the GDPR, and it pushes the assessment towards both reporting and telling the customer.
If you report to the regulator but decide not to tell the individuals, the ICO notes that it can still require you to inform them if it considers the risk high. Record why you decided as you did.
What goes in the breach log
Every breach goes in your internal breach log, including the ones you do not report. Article 33(5) asks for the facts, the effects and the remedial action you took. For an AI breach, add four things that make the record useful later: which tool, which account, which types of data, and why you did or did not notify.
The log is also where patterns show up. Three entries in a quarter, each a personal ChatGPT account used for the same kind of task, tell you more about your policy than about your staff. The ICO suggests investigating whether a breach came from human error or a systemic issue, and how to prevent it happening again.
Preventing the next report
Start with why the employee reached for a personal account. The answer is usually mundane: there was no approved tool for this task, or nobody knew about it. The Dutch authority's advice is to agree clear rules with staff on whether chatbots may be used and, if so, which data may and may not go in. An approved alternative, such as Microsoft Copilot under the organisation's own Microsoft 365 tenant, takes much of the pressure off. How to set such a rule and make it stick is covered in how to enforce an AI policy.
Then help people at the moment they paste. The complaint could have been rewritten just as well with [name] and [account number] in place of the real details, and the remark about the illness did not need to go in at all. Our prompt redaction guide shows how to take data out without losing the point of the question, and what not to share with AI lists what never belongs in a prompt.
A breach report comes after the fact. What comes before it is knowing which AI tools are in use and where sensitive data is involved. See shows that in counts and data types, never what anyone typed. When someone pastes text, sensitive details are highlighted in the text and the employee chooses to mask or remove them, unless the organisation has set masking to happen automatically. How that works is on the Help page, and privacy teams who handle these reports have their own page: AI governance for privacy officers.
