Practical guide · Data & governance
Can employees use ChatGPT at work without exposing company data?
Juthūr editorial teamReviewed: 6 min read
The short answer
Yes — if the company decides which AI tools are approved, configures them for business use, and tells employees clearly what they may and may not enter. The main risks are confidential or personal data leaving the organization, inaccurate answers being trusted, and personal accounts being used outside company control. Data-protection laws across the region, such as the Saudi and UAE PDPLs, regulate personal data in these tools, so map what data is involved before you allow it.
Key takeaways
- 01
Banning AI rarely works; staff use personal accounts instead. Offer an approved option.
- 02
Choose business plans or services whose data, retention and training settings you control.
- 03
Classify data: public, internal, confidential, personal — and set a rule for each.
- 04
Require human review before AI output reaches customers or decisions.
- 05
Personal data in prompts can trigger data-protection obligations, including on cross-border transfers.
01
What can actually go wrong
- Leakage: staff paste contracts, customer lists or personal data into tools the company does not control.
- Wrong answers: confident but incorrect content is sent to customers or used in reports.
- Shadow AI: personal accounts and browser extensions bypass company security and logging.
- Manipulation: documents or web pages containing hidden instructions alter what an AI tool does.
The OWASP Top 10 for large language model applications lists sensitive information disclosure and prompt injection among the most important risks for applications built on these models.[3]
02
What data-protection law means for AI tools
When an employee enters personal data into an AI tool, that is processing under data-protection law — and if the tool runs abroad, it may also be a cross-border transfer. Saudi Arabia's PDPL restricts transfers outside the Kingdom to defined purposes and routes, and the UAE's federal PDPL (Federal Decree-Law No. 45 of 2021) permits transfers through adequacy or specified alternatives and exceptions.[1][2]
SDAIA has also published generative AI guidelines for the public, covering responsible use, privacy and verification of outputs.[4]
This is not legal advice. Our country briefs summarize the law in each market we serve; for regulated sectors, also check sector rules and involve your legal or compliance team.
03
A one-page AI usage policy
- 1
Approved tools
Name the tools staff may use for work and how to get access. Everything else is not for company data.
- 2
Data rules
Public and general internal information: allowed. Confidential business data: only in approved tools configured for it. Personal and customer data: only in specifically approved workflows.
- 3
Review
A person checks facts, figures and tone before AI output is sent externally or used in a decision.
- 4
Disclosure
State when customers are interacting with AI and where AI-generated content must be labelled.
- 5
Reporting
Tell staff whom to contact about a mistake, a suspected leak or an unsafe output.
04
Setting up approved tools
- Prefer business or enterprise plans with company-managed accounts and single sign-on.
- Check in the provider's current terms whether inputs are used for model training, and how long data is retained.
- Confirm the processing location and the transfer basis for personal data.
- Turn on administration features: user management, logging and data-retention settings.
- For sensitive workflows, use an internal assistant connected only to approved company knowledge.
Common mistakes
A total ban
Bans push usage underground. A controlled, approved option is safer.
Policy without training
Staff need examples of what is allowed, not just a document to sign.
Trusting AI citations
Generated references and figures must be checked against the original source.
Forgetting customers
If AI talks to customers, they should know and be able to reach a person.
How Juthūr can help
These services and free tools pick up where this guide ends.
Frequently asked questions
Is it legal to use ChatGPT in a company in Saudi Arabia or the UAE?
Using generative AI is not prohibited as such, but processing personal data through it must comply with data-protection law, including rules on transfers abroad. Many companies limit use to approved tools and keep personal data out unless a workflow is specifically approved. This is not legal advice.
Do AI providers train on what employees type?
It depends on the provider, the plan and the settings. Check the provider's current terms and administration options before approving a tool.
Should we build our own internal ChatGPT?
An internal assistant connected to approved company knowledge is useful when staff need answers from internal documents or handle sensitive data. For general drafting, an approved business plan is often enough.
Can Juthūr help us create an AI policy?
Yes. We help define approved tools, data rules, review steps and training, and connect them to the workflows where AI is used. Start with a free consultation.
Sources
Facts in this guide are linked to the sources below. Statements marked as recommendations are Juthūr's professional view.
- [1]Personal Data Protection Law — Saudi Arabia (transfer summary)DLA Piper, Data Protection Laws of the World
- [2]Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal DataUAE Legislation (official portal)
- [3]OWASP Top 10 for Large Language Model ApplicationsOWASP Foundation
- [4]Generative Artificial Intelligence Guidelines for PublicSaudi Data & AI Authority (SDAIA)
Related questions
Want this applied to your business?
Tell us about the workflow you want to change. We will help you see where AI fits, what it takes and how to measure it.