The meteoric rise of ChatGPT has seen 180.5 million users adopt the tool worldwide, changing the way they seek out information, interact with AI, and for many, change the very way they work. Using the system has helped many become more efficient in their roles.

However, with a cited 15% of employees regularly sharing sensitive data with OpenAI’s revolutionary chatbot, the need for a stringent Data Loss Prevention (DLP) strategy that ensures data is fully protected is crucial.

As a productivity-enabler, ChatGPT should not be underestimated, and while companies like Samsung have banned the tool entirely, organisations should take an approach that benefits their employees, whilst maintaining their data privacy.

In this guide, we will lay out the security risks of using ChatGPT, and offer guidance on how companies can keep their data secure, while making the most of the tool.

What are the security risks of AI tools like ChatGPT?

ChatGPT can be a great source of information and an enabler of productivity amongst the workforce. However, individuals should exercise caution when using any generative AI tool, including ChatGPT.

This is due to the fact that any third-party AI tool comes with inherent security risks, and cannot entirely offer the data protection an organisation needs. Any sensitive data shared with the system has the potential to be intercepted or accessed via malicious software, compromising data privacy and confidentiality.

Similar to other software, AI tools are not immune to vulnerabilities. In fact, their novelty often introduces a higher likelihood of undiscovered weaknesses. Unidentified vulnerabilities within these tools can potentially compromise their security, enabling unauthorised access to sensitive data.

Individuals sharing confidential information with AI tools, such as ChatGPT, may inadvertently violate privacy regulations, irrespective of their intentions. It is crucial to acknowledge that information provided to a Large Language Model (LLM) like ChatGPT may be utilised for training purposes. OpenAI explicitly advises against sharing sensitive data with ChatGPT to mitigate privacy risks.

As AI establishes itself as a reliable productivity tool for global teams, personnel should exercise prudent judgement to minimise the risk of errors that could lead to severe consequences, such as the inadvertent disclosure of source code. Updating data security policies to accommodate the integration of AI tools is essential to mitigate security risks and uphold the confidentiality of data.

How can I protect sensitive data in ChatGPT?

As with any other Software-as-a-Service (SaaS) tool, the safeguarding of sensitive data, including PII, PHI or PCI, within ChatGPT is imperative for security professionals.

The accelerating integration of ChatGPT as a productivity enabler underscores the necessity of judicious use, as any attempts to curtail its application may provoke discontent among staff who perceive it as a highly efficient information source. Consequently, fostering employee awareness and education becomes a critical component in the overarching goal of protecting sensitive data and maintaining a high-output business environment. Users must be cognisant of the ethical considerations and data privacy imperatives to ensure the protection of both customer and employee data.

To mitigate the risks associated with Shadow IT practices, security teams must exercise diligence in monitoring employee usage to ensure alignment with regulations such as GDPR and HIPAA. The implementation of auditing tools becomes instrumental in enabling teams to vigilantly track the sharing of sensitive data with ChatGPT, promptly identifying and addressing any emerging risks.

In instances where sharing sensitive data with ChatGPT is unavoidable, a balanced approach involves employing generic information, with critical elements such as names or medical conditions redacted. The use of pseudonyms or numerical placeholders serves to further obfuscate real details.

Recognising ChatGPT as a beneficial tool within the organisational framework, security teams must establish a shared responsibility for data security with the AI provider. Prior to the implementation of ChatGPT, a comprehensive understanding of how the tool handles, processes, and protects data is vital. This understanding allows for the effective implementation of measures to address any potential security gaps.

A robust DLP strategy is indispensable in ensuring the proactive monitoring of sensitive data input into the system. Swift remediation of risks, either manually or through automated tools, is crucial to limiting the over-exposure of confidential information.

The utilisation of ChatGPT necessitates a meticulous approach to data security. Security professionals should prioritise the awareness and education of employees, monitor data usage, and implement stringent DLP strategies to fortify the organisation against potential risks and vulnerabilities associated with the use of ChatGPT.

Does ChatGPT have DLP built in?

ChatGPT has very limited DLP functionalities. Within ChatGPT Enterprise, data is encrypted during transmission, rendering it indecipherable to unauthorised users and preventing interception. Additionally, the system retains data for a restricted duration, thereby minimising the attack surface in the event of a potential system breach.

While these security measures offer an initial layer in safeguarding sensitive data, it is essential for organisations not to rely solely on ChatGPT's data security methods. Instead, organisations should adhere to their own security policies, aligning them with established SaaS security measures.

In essence, while ChatGPT's inherent security features contribute to data protection, a comprehensive and layered security approach, encompassing both the tool's native capabilities and organisational policies, is imperative to ensure the safeguarding of customer information and overall data integrity.

Does ChatGPT adhere to data regulations like GDPR?

No, ChatGPT does not comply with GDPR or any other regulatory requirements, as the responsibility for compliance lies with the user. To ensure GDPR adherence, organisations should restrict the sharing of sensitive data with the tool.

How can your organisation stay secure while using ChatGPT?

For any organisation utilising ChatGPT or any AI-powered tool, prioritising data security is crucial. Here are several measures to enhance your organisation's data security within ChatGPT:

1. Implement a Data Security Tool: Consider integrating a data security platform like Metomic to gain insights into who is using the tool and the nature of data being shared.

2. Limit Sharing of Sensitive Data: Exercise prudence in sharing sensitive data with ChatGPT. This includes but is not limited to customer information, financial records, Intellectual Property (IP), and company secrets.

3. Secure ChatGPT Accounts and Devices: Strengthen the security of ChatGPT accounts and associated devices by employing robust passwords and implementing Multi-Factor Authentication (MFA).

4. Encrypt Data in Transit: If ChatGPT is utilised within the organisation's applications or systems, ensure that data is encrypted during transit. This measure adds an extra layer of protection to sensitive information.

5. Maintain Regulatory Compliance: Adhere to relevant regulations such as GDPR, HIPAA, and PCI DSS. Compliance with these standards is essential to safeguarding consumer interests and ensuring data privacy.

6. Employee Education on Best Practices: Educate employees on best practices to minimise the input of sensitive data into the system. Additionally, emphasise the importance of reducing any outputs that may contain sensitive information.

By diligently implementing these measures, organisations can significantly enhance the overall data security posture when utilising ChatGPT or similar AI-powered tools.

What data does Metomic detect in ChatGPT?

When you implement Metomic’s ChatGPT browser plugin, you’ll have access to over 150 out of the box classifiers that detect sensitive data as well as custom classifiers to suit your needs.

We detect many different types of data, including:

Customer PII & PHI
Secrets and API keys
PCI data
Intellectual property
Financial data
Confidential data
Special category data

Why use Metomic for ChatGPT?

We are one of the few Data Security platforms for ChatGPT, as we understand how important it is for our customers to have full visibility into the tool.

Get full visibility over who is using ChatGPT and what sensitive data they’re sharing with it, with real-time scanning that shows the latest alerts

Creating a Saved View for ChatGPT within Metomic will give you a weekly summary of activity in your Slack alerts channel.