Is putting data into ChatGPT always a personal data breach?

Not always. It depends on which data it was, which tool and settings were used, and the contract with its provider. That is why a quick assessment is needed.

Do we have to report it if it was only names and e-mails?

If a risk to the people concerned cannot be ruled out, yes, within 72 hours of becoming aware. Record your assessment even if you conclude that no report is needed.

Can we claim compensation from the employee?

Yes, but for negligence usually only up to 4.5 times their average monthly earnings. The amount and process depend on the circumstances and on whether the company had AI rules in place.

Client data in ChatGPT: what a company must do

Short answer

It can be a personal data breach. If clients' personal data reached a public AI tool, the company must assess the risk without undue delay. If a risk to the people concerned cannot be ruled out, it must report the breach to the Czech data protection authority (ÚOOÚ) within 72 hours of becoming aware of it. If the risk is high, it must also inform the clients affected. If trade secrets or contractually confidential information were involved, the company also risks a dispute with its business partner. An employee's liability for damage caused by negligence is limited.

Quick answers

Is putting data into ChatGPT always a personal data breach?: Not always. It depends on which data it was, which tool and settings were used, and the contract with its provider. That is why a quick assessment is needed.
Do we have to report it if it was only names and e-mails?: If a risk to the people concerned cannot be ruled out, yes, within 72 hours of becoming aware. Record your assessment even if you conclude that no report is needed.
Can we claim compensation from the employee?: Yes, but for negligence usually only up to 4.5 times their average monthly earnings. The amount and process depend on the circumstances and on whether the company had AI rules in place.

When this situation arises

An employee asked AI to summarise a client contract or e-mail
A spreadsheet with names, contacts or ID numbers ended up in a chatbot
Internal price lists, offers or source code were given to AI
A client asks where their data went

What options do you have

Assess the leak with a lawyer

A lawyer helps decide whether it is a breach, whether it must be reported and what to tell clients.

Deal with the impact on clients and partners

If the leak breached a contract or confidentiality duty, a lawyer assesses liability and prepares the communication.

Set rules for the future

An internal AI policy, approved tools and supplier contracts reduce the risk of it happening again.

Recommended step-by-step process

1.
What can happen
A fine from the ÚOOÚ for an unreported breach, clients' claims for compensation, and a dispute with a partner over breach of confidentiality.
2.
What a lawyer does
Assesses which data leaked and to whom, decides with you on reporting, and prepares statements for clients and the authority.

What documents to prepare

A record of exactly what was entered and when
Details of the AI tool used and its settings
Contracts with clients and partners containing confidentiality clauses
Internal rules on AI use, if any

Common mistakes

Waiting for a client to complain instead of assessing at once
Assuming that pasting data into an AI tool is not a data leak
Dismissing the employee immediately without an investigation and without knowing the limits of their liability
Having no rules on which AI tools staff may use and for what

Risks and important deadlines

72-hour deadline

The report to the ÚOOÚ is due within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights of the people concerned.

Informing the people affected

Where the breach is likely to result in a high risk, the company must also inform the clients affected without undue delay.

Limited employee liability

For damage caused by negligence an employee is usually liable up to 4.5 times their average monthly earnings; for intentional damage, in full.

When it's worth contacting a lawyer

Immediately after you find out, because the reporting deadline is only 72 hours. A lawyer helps assess the risk, the report and the communication with clients. Lawyers' services are paid; only submitting a standard request through LawBridge is free.

Describe your case

Frequently asked questions

What does a lawyer's help cost?

It depends on the scope. Lawyers' services are paid; a standard request through LawBridge is free.

Verified sources

General Data Protection Regulation (GDPR), Articles 22, 33 and 34 — EUR-Lex
Reporting a personal data breach — Czech Office for Personal Data Protection (ÚOOÚ)
Act No. 262/2006 Coll., Czech Labour Code (§ 257, § 316) — Zákony pro lidi
Act No. 89/2012 Coll., Czech Civil Code (§ 504 trade secrets) — Zákony pro lidi

An employee put client data into ChatGPT. What now?