ChatGPT at work and data protection: the options from SaaS to your own servers

Which options are there for using ChatGPT at work?

There are four, and what separates them is what leaves the company and who controls it. The concern is widespread: in Bitkom's survey published on 14 September 2026, companies that use AI named data protection requirements as their biggest barrier (66%), and 45% feared that company data could fall into the wrong hands. Most companies still start with free tools: in the IW future panel published in IW-Trends in July 2025, 37% of companies used AI, most of them free tools such as ChatGPT or Copilot, 14% paid services and about 4% their own systems.

The steps are not exclusive. Many companies combine them, for example a business tier for general writing and an assistant on their own servers for personnel or customer data.

Can staff use their private ChatGPT accounts for work?

Not for company data. With private accounts, company data goes to a provider the company has no contract with. A labour lawyer at Pöppel Rechtsanwälte (5 May 2026) points out that employees who enter personal data into an AI tool on the employer's behalf trigger processing for which the employer remains responsible, and that entering sensitive information into a generative AI tool counts as disclosure and can end trade secret protection under the German Trade Secrets Act (GeschGehG). Without a contract there is no processing agreement, no say over retention and no way for the company to have anything deleted.

The company also cannot see what goes out. An administrator on administrator.de put it plainly: "Ob der MA da Kundendaten reinschüttet, weiß natürlich niemand" (nobody knows whether the employee pours customer data into it). That is why the next steps give people a tool the company controls instead of only forbidding the one they already use.

What do business and enterprise tiers settle, and what do they leave open?

A business or enterprise contract gives the company what private accounts lack: a contract partner, central user management and settings an administrator controls. What it does not change is where the processing happens: prompts, uploaded files and answers are processed in the vendor's infrastructure under the vendor's terms. Whether that is acceptable depends on the data, and terms change, so check the current version rather than relying on a summary, including ours.

German buyer checklists ask the same three questions again and again: "Wo laufen die Modelle?", "Werden Daten zum Training weitergegeben?" and "Gibt es eine Auftragsverarbeitung?" (where do the models run, is data passed on for training, is there a processing agreement). Put them to the vendor in writing, together with two more:

• In which countries are prompts, files, answers and logs processed and stored, and can you choose a location in the EU?
• Is any input used to train models, by default or through a setting someone could switch on?
• Is there a processing agreement (AVV, the contract under Article 28 GDPR for processing on your behalf), and which sub-processors does it list?
• How long are conversations, files and logs kept, also after a user deletes them, and who at the vendor can see them, for example for abuse monitoring?
• What do administrators see about individual users, and can those reports be limited? The works council will ask this

If the answers are good enough for the data your people will use, a business tier is the simplest option. If they are not, move up a step.

Can we run a ChatGPT-style assistant in our own cloud account in the EU?

Yes, on Azure OpenAI or Amazon Bedrock. In this step staff use a chat interface that the company runs, connected to models in the company's own cloud account. Prompts still go to a cloud provider, but under the cloud contract you already have for your other systems, in a region and deployment type you choose, with the interface, the user list and the logs in your own account. Open-source interfaces such as Open WebUI or LibreChat look and work much like the public tools, with chat, file upload and history. For many companies this step strikes the best balance between data protection and ease of use.

Two details decide whether data stays in the EU. On Azure OpenAI, the deployment type you call matters more than the region where you create the resource. On Amazon Bedrock, it is the region or inference profile you call. Our guide to EU data residency on Azure OpenAI and Amazon Bedrock lists the settings, explains who can see prompts for abuse monitoring and notes that an EU region settles where data is processed. It does not settle which country's law can reach the provider.

Put an LLM gateway between the interface and the models: one controlled access point to all models, with keys, budgets and logs. It allows only EU endpoints, gives each team a budget and keeps a record that you configure. It also changes the cost model: instead of a licence per user, you pay for actual model use plus operating the platform. One administrator on administrator.de describes such a setup as "deutlich günstiger als personalisierte Zugänge" (clearly cheaper than personal licences). Whether that holds for you depends on how many people use it and how much.

What if data may not leave the house at all?

If certain data may not go to any external provider, for example personnel files, health data, design documents or data a customer contract keeps in your data centre, run the model yourself. An open-weight model is a model whose weights you can run on your own servers. Prompts, documents, answers and logs then stay in your data centre, and no provider sees them.

More of the Mittelstand is going this way. In a survey by CIO and Computerwoche with Dell, published on 3 September 2026 (106 IT leaders of DACH SMEs, vendor-sponsored), 20% had started building local server infrastructure for AI, and the report describes SMEs wanting to run their language models and workloads where their data is.

It takes more work: hardware, a serving engine, updates, monitoring and tests after every model change. You also need a model that is good enough in German for your tasks, which you should test on your own cases. Our guide to on-premise LLMs for companies covers the layers and how to size the hardware. If what you need is processing in the EU under a contract rather than no outside processing at all, the step with your own cloud account is usually less work.

What does the works council have to do with it?

The works council becomes involved as soon as the company runs the system. Under section 87(1) no. 6 of the Works Constitution Act (BetrVG), co-determination applies when a system is objectively capable of monitoring behaviour or performance, whatever the intent. The Hamburg Labour Court (16 January 2024, 24 BVGa 1/24) found that it did not apply where staff used ChatGPT in the browser and the employer had no access to employee data through the AI. Once the company provides its own tool and holds the logs, that reasoning no longer fits, so plan the works agreement together with the platform.

Bitkom's guide on AI and co-determination (early 2026) recommends that a works agreement says who may access which data and "wie Zugriffe protokolliert werden" (how access is logged). On your own cloud account or your own servers you configure those logs yourself: team keys instead of names, prompts not stored by default, short retention and aggregated reports. Our guide on works council and AI system logging shows the settings. This is the technical side. Your company decides, advised by its data protection officer and lawyers, and nothing here is legal advice.

Which option fits, and what happens if we offer none?

Let the most sensitive data people will need to use decide. For general writing and public information, a business tier can be enough. For customer, contract or personnel data that may be processed in the EU under a contract, your own interface on your own cloud account fits. For data that may not leave the house, your own servers. Many companies end up with two steps side by side.

Offering nothing is also a choice, and it leads to shadow AI: tools staff use for work without the company providing them. In the IW Köln short report of 19 September 2026, 29.1% of employees who use AI at work used tools their employer did not provide. Bitkom (21 October 2025) found that the share of firms reporting widespread use of private AI tools doubled from 4% to 8% in a year, and a further 17% saw individual cases. Our guide on shadow AI explains why bans fail and what an approved alternative looks like.

To start, take stock of what is already in use and what it costs: the free AI usage review puts spend and quality on one page, built from exports you choose to send. To talk through which step fits your data, talk to an engineer: a free 30-minute call that needs no access to your systems or data.

Azure OpenAI and BedrockOn-premise AIData protection officers