ChatGPT Team Data Privacy: What Your Team Must Check
Check training use, retention, sharing, administrator access, and connected apps separately before approving a team workspace. Turn the answers into clear rules people can follow.
Updated 5 min read
ChatGPT team data privacy depends on the workspace’s actual plan, settings, contract, and connected services. Check model training, retention, sharing, and administrative access separately; a favorable answer about one does not settle the rest. The practical goal is a written answer about which information your team may use for which work.
fenbs can keep the approved data-handling rules available to every connected assistant. Store the decision and its scope there, rather than copying the sensitive information the decision governs.
What does the workspace privacy review need to cover?
Begin by identifying the exact workspace. If internal documents call it ChatGPT Team, compare that wording with the current account label and agreement. Do not apply an older screenshot, a colleague’s personal-account settings, or an Enterprise contract to a different workspace.
| Privacy question | Evidence to request | Decision it supports |
|---|---|---|
| Is content used for training? | The applicable product commitment and any exceptions. | Which information categories the company will permit. |
| What is retained? | Rules for conversations, files, and other enabled features. | How the workflow fits the company’s record policy. |
| Who can receive content? | Sharing settings and intended audience. | Where drafts and approved outputs belong. |
| Who can review activity? | Documented administrator and compliance capabilities. | What employees should be told about workplace use. |
| What leaves through connections? | Authorized accounts, services, and allowed actions. | Which connections and tasks need separate approval. |
Write down the evidence location and the person who confirmed it. “Private” is too broad to serve as the whole answer. A useful result says that a named category of internal work is approved in a named workspace, subject to defined sharing and review boundaries.
Does no training mean no storage?
No. Training describes one use of information; retention describes keeping it. OpenAI’s cloud security guidance (opens in a new tab) says Business, Enterprise, and Edu workspace data is not used to train models by default, while different data categories can follow different retention behavior. Verify the feature you will use, not just the headline commitment.
Ask about the full workflow: prompt, attachment, generated document, saved file, and any exported result. A retention answer about conversations might not answer the saved-file question. Include the destination of the final output, since your own shared drive or document system also has a record to manage.
Do not promise immediate erasure because an employee can delete something in the interface. Ask what deletion initiates, what exceptions apply, and who handles requests. If your work needs a specific retention guarantee, have the responsible reviewer confirm it against the agreement before you use real information.
How should you evaluate sharing and workspace visibility?
Map the intended audience for each output. A draft for its author, a project page for colleagues, and a public deliverable should not share one blanket approval. Ask what happens when content is copied from a restricted source into a shared destination.
OpenAI’s Space administration guide (opens in a new tab) distinguishes private chats from shared pages and says content copied or summarized onto a page is visible to that page’s collaborators. In practice, review the destination text itself. A harmless-looking summary can still disclose a confidential project name or an employee’s circumstances.
Keep ordinary collaboration separate from compliance review. Ask the workspace owner what authorized administrative processes apply and what employees are told. The workspace visibility guide covers that narrower question; this review should record its conclusion without rebuilding the entire access analysis.
Put the approved audience and the prohibited content categories in fenbs Decisions and rules, where they can accompany the work even when people change assistants.
What changes when you connect another service?
A connection adds an account and another service to the information path. Ask who controls that account, which resources it can reach, and whether its tools only retrieve information or can change it. Review the permissions shown during authorization against the actual task.
OpenAI’s workspace connections guide (opens in a new tab) explains that company-managed connections have their own authorized accounts and access controls. A shared account can have a different reach from the requesting employee. Treat that account as part of the review instead of assuming every connection follows the employee’s personal access.
For example, a hypothetical operations team wants a summary of approved procedure pages. Start by identifying that collection and the account that reads it. An account that also reaches HR records needs a narrower setup or a different design before the procedure-summary task is approved.
Review revocation as well as sign-in. Name the person who disconnects a service and checks source-system access when ownership changes. Do not treat revocation as proof that previously generated documents or copied summaries have disappeared.
What should an approved data-handling rule say?
Write for the employee choosing what to paste. Name allowed categories, excluded categories, permitted workspace, intended purpose, and the person who answers exceptions. A rule that only says “use good judgment” passes the difficult decision back to the person who asked for help.
- Workspace: use the company-approved account and confirm the workspace before supplying material.
- Input: use published procedure pages and approved internal summaries for this workflow.
- Exclusions: do not include employee records, customer records, credentials, or other categories the owner has excluded.
- Output: have the designated reviewer check the answer and the intended audience before sharing it.
- Exceptions: ask the policy owner before adding a new data category, connection, or audience.
These are example boundaries to adapt, not a statement that your company has approved them. A person should choose the actual rule. OpenAI’s Work admin FAQ (opens in a new tab) also emphasizes that data commitments depend on plan, configuration, surface, feature, and region; capture that scope in the approval.
Keep the approval beside the work
Record the human-approved data categories, workspace, audience, and exceptions in fenbs Decisions and rules. Connected assistants read Rules first in the project context. Use tasks for unresolved privacy checks so an incomplete review stays visible instead of becoming an assumed approval.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
How to do this with fenbs
- Create a free account, free for one person with no credit card, and add the project whose AI workflow you are reviewing.
- Add tasks for the separate training, retention, sharing, and connection questions. Put the evidence needed and the next check in each task’s plan.
- Record what the responsible person approved in Decisions and rules. Keep the policy summary useful without storing the confidential source material.
- Connect a supported assistant through Integrations. MCP is a standard way for an AI app to use an outside tool; ask the assistant to read the approved context before starting.
- Save progress with the resolved checks, open questions, and next reviewer action. Use a team kanban board with suitable member roles when colleagues maintain the record together.
fenbs does not configure ChatGPT retention, run a privacy assessment, or provide the same contractual guarantees as your AI vendor. It is not the right fit if you need a policy enforcement or data-loss prevention system. Use it for a clear, attributed record of what people approved and what remains unresolved.
For the rest of the working setup, see apps for teams; for choosing an assistant, use Copilot versus ChatGPT. Keep this privacy review specific to the chosen workflow, and use the AI governance hub when its scope changes.