ChatGPT Enterprise DLP: Controls and Team Responsibilities

Data-loss prevention (DLP) in the context of ChatGPT Enterprise is not a single control but a set of decisions about what data enters the tool, which connected tools it can reach, and what organizational rules govern both. ChatGPT Enterprise does not include a built-in DLP engine in the way some email or endpoint security tools do, but it does provide settings and commitments that affect how your data is handled.

The gap between what the platform provides and what your team needs to do independently is where most data-handling risk lives. A tool like fenbs gives teams a place to record the approved handling rules and review responsibilities so those decisions are visible and current, not buried in an onboarding document from the day the account was created.

What ChatGPT Enterprise provides for data handling

ChatGPT Enterprise includes certain commitments that affect how conversation data is treated. By default, conversation data is not used to train OpenAI models. There are admin controls over which features are available to users in the workspace. For the current list of enterprise data controls, check the OpenAI help center↗ (opens in a new tab) directly, as these change with product updates.

Administrators can manage which integrations and connected tools are available to workspace users. Restricting connected tools limits what data the model can reach automatically, which is relevant when your documents, email or other services are connected.

What ChatGPT Enterprise does not do: it does not scan outgoing prompts for sensitive data patterns the way a dedicated DLP system would. If a user types a social security number or a health record into a prompt, the platform does not block the input. That responsibility stays with the user and the team's own rules.

What your team is responsible for

Your organization is responsible for the data that enters ChatGPT. The platform's data commitments apply to what you send; they do not prevent you from sending data that should stay private.

This means you need to decide: which categories of data may be used in prompts, which data is off-limits entirely, and whether certain teams or projects need stricter rules than others. Those decisions should be written down, not left to individual judgment.

You also need to decide which connected tools and integrations are permitted. If your workspace is connected to your organization's documents, email or calendar, you are expanding what data the AI can reach. Each connection should be reviewed and approved, not added opportunistically.

How to set DLP boundaries in practice

Start with a data classification. What data does your organization handle? Sort it into categories: public, internal, confidential, and restricted. Then decide which categories may be used in ChatGPT prompts and which may not. Write that down as a policy.

For confidential and restricted data, the rule is usually a prohibition: do not paste this into any AI tool. That is a simple instruction that anyone on the team can follow. For internal data, the rule may be more nuanced: you may describe the situation in general terms but not paste the raw record.

For each connected integration, name the specific integration, what data it exposes, and who approved the connection. A list of approved integrations with a date and a reviewer makes the next audit far simpler.

See Claude vs ChatGPT and ChatGPT for business for context on how data handling compares across AI tools your team might use.

Review connected tools and their boundaries

ChatGPT can be connected to various tools and data sources. When a connection is active, the AI can access that data automatically during a session, even if you did not explicitly provide it in a prompt. Review the active connections in your workspace admin settings.

For each connection, ask: what data does this allow the AI to read? Is that data covered by your data-handling policy? Who approved this connection and when? A connection that made sense when it was set up may no longer be appropriate if the project or the data classification has changed.

Document each connection review. Write the date, what was checked, and whether each integration was kept or removed. That record matters when a security review asks whether your organization actively governs its AI tool access, rather than relying entirely on the initial setup.

How to do this with fenbs

1. Create a free account. Start a project for AI governance and data-handling rules.
2. Add a Decision for each data category your team handles, stating what is permitted and what is off-limits in AI prompts.
3. Add a Decision for each approved connected integration, naming the integration, what data it exposes, and who approved it.
4. Connect your AI apps over MCP from Integrations so they read the Decisions before working on tasks that touch sensitive data.
5. Schedule a quarterly review. Add it as a task with a next-step note so the review happens rather than slipping.

A personal board is free and a useful place to track your own data rules. A team board gives each member a role and keeps the History of every policy change, which is useful when an auditor asks who approved a specific decision.