Is pseudonymisation enough for GDPR?

Pseudonymisation is a safeguard GDPR itself recognises (Article 4(5) and Article 32). While you hold the key it remains personal data processing on your side, but the personal data you replaced is no longer in what you send to the AI vendor. That supports minimisation; it is not a guarantee that you are compliant.

Should this go into my processing register?

If you process client documents with AI structurally: yes, record the workflow. A fixed, documented route with pseudonymisation is easy to describe there.

Does this apply to Claude, Gemini and Copilot too?

Yes. GDPR looks at what you send, not at which brand receives it. The safe route is the same for every AI.

My client says it's fine. Allowed then?

Client approval helps, but minimisation still applies, and a company's approval does not automatically cover the individuals in the document (employees, counterparties). Replacing the personal data first remains the stronger route.

All guides

Can I upload client data to ChatGPT?

The short answer. Usually not as-is. The moment a document contains client personal data, uploading it to ChatGPT is processing under GDPR. You remain responsible, even on a paid plan. It is only allowed if you have a legal basis, apply data minimisation and can account for the processing. The practical route is to first replace the details the task doesn't need, such as names, contact details and account numbers. Then you upload a protected document instead of the raw client data. ShareSafe.ai does that for one file at a time, without an account.

→ Protect your document first

Why this is not a formality

Three reasons "just quickly into ChatGPT" becomes your problem, not OpenAI's:

You are the controller. Your client gave their data to you, not to an American AI company. When something leaks or someone complains, the regulator looks at you.
Data minimisation is a hard requirement. Article 5 GDPR: process no more data than necessary. For a summary or analysis, ChatGPT usually doesn't need the real names or account numbers. Sending them is more than necessary.
Your professional duty or contract may be stricter than GDPR. Many advisory agreements, NDAs and professional rules prohibit sharing client information with third parties. An AI vendor is a third party.

"But I have ChatGPT Business, so OpenAI doesn't train on my data"

True, and that matters. ChatGPT Business (formerly ChatGPT Team) doesn't train on your business data by default. But not training is a different subject than not sending. On a business plan you still send the raw client data to OpenAI. Your client's question is not "was it trained on?" but "why was my data there at all?". Minimising what you send answers both. More on this: ChatGPT Business and confidential documents.

When is it allowed?

A quick decision line:

No personal data in the document? Then GDPR does not apply and you are bound only by your contracts.
Personal data, but replaced with placeholders and you hold the recovery key? Then the personal data you replaced doesn't reach the AI vendor, which fits minimisation well. Check the rest of the text for details that still point to someone. This is the workable route for daily use.
Raw personal data with explicit consent and a processor arrangement? Legally possible, practically heavy: consent must be specific and revocable, and you must be able to account for the whole chain.

The middle route is the right one for most advisory practices. Not because it is a legal guarantee, but because it is fast and you can explain it.

The safe route

Drop the client document into ShareSafe.ai. No account, processed in the EU, not kept as a file.
Review what was found: names, companies, IBANs and addresses become consistent placeholders. Replace data the task doesn't need. Leave amounts the model has to compare or calculate with.
Download the protected file and your recovery key (Identity Key). The protected file goes to ChatGPT; the key puts the real names back in the answer. The key is given to you and ShareSafe Free keeps no copy.

Placeholders replace personal data. Contract terms, trade secrets or medical content stay readable. In the review step you can select extra text and have it replaced too.

FAQ

Is pseudonymisation enough for GDPR?: Pseudonymisation is a safeguard GDPR itself recognises (Article 4(5) and Article 32). While you hold the key it remains personal data processing on your side, but the personal data you replaced is no longer in what you send to the AI vendor. That supports minimisation; it is not a guarantee that you are compliant.
Should this go into my processing register?: If you process client documents with AI structurally: yes, record the workflow. A fixed, documented route with pseudonymisation is easy to describe there.
Does this apply to Claude, Gemini and Copilot too?: Yes. GDPR looks at what you send, not at which brand receives it. The safe route is the same for every AI.
My client says it's fine. Allowed then?: Client approval helps, but minimisation still applies, and a company's approval does not automatically cover the individuals in the document (employees, counterparties). Replacing the personal data first remains the stronger route.

ShareSafe.ai keeps raw files in the EU. Minimal retention. You hold the key. Try it with your own document →