The gist.
Many AI users are rushing ahead with ChatGPT and custom GPTs but ignoring the most basic steps to protect their data, which leaves sensitive information exposed, retained, or even accessible to outsiders. With ChatGPT now functioning like one of the world’s largest search engines, failing to take precautions is the same as publishing your information online.
Why it matters.
- Defaults are risky: Platforms often keep data retention and model training toggles “on” by default. If you do not opt out, your prompts and files may be used for training or stored longer than you realize.
- Sensitive inputs leak: Uploading personal, financial, or proprietary information can backfire. A recent study found over 98% of custom GPTs are vulnerable to “instruction leaking,” which means hidden rules or data could be revealed with adversarial prompts.
- Search visibility: ChatGPT is rapidly becoming one of the top search engines globally. Treat what you type as potentially visible beyond your session. If you would not publish it on a website, do not feed it into ChatGPT.
- Regulatory pressure: Regulators are starting to fine AI developers (for example, Italy fined Replika’s creator €5.6M) for misuse of user data, which signals increased scrutiny ahead.
Getting started in protecting yourself and your business.
- Check your account settings
- In ChatGPT, open settings and go to “Personalization”, then under “Memory,” disable “Reference memories” and “Reference chat history” if you do not want previous memories and chat history to be stored (you can also click “Manage” to edit them manually).
- In ChatGPT, open settings and go to “Data controls,” then disable “Improve the model for everyone” if you do not want your prompts shared with the LLM.
- When building custom GPTs, review the “Use my data to improve model performance” box and uncheck it if privacy matters.
- Limit what you share
- Never enter passwords, customer PII, or proprietary data or documents unless they have been scrubbed and/or approved for use.
- Keep knowledge base uploads lean with only what the GPT truly needs.
- Add human review
- Do not paste AI outputs directly into public channels. Always review for sensitive content, hallucinations, or leaks.
- Rotate and secure keys
- If you are connecting APIs, store keys securely, rotate them often, and monitor for unusual activity.
- Educate your team
- Create a simple AI policy that outlines what is safe to input, what is not, and how to configure settings correctly.
Helpful links:
