ChatGPT (free) can be used at work only under specific conditions. Our verdict for a typical 50–500 person company handling client or regulated data: Limited. Personal consumer accounts sit outside company control — fine for public-information tasks, never for client or regulated data. This is the single most common shadow-AI channel: an employee pasting work content into a personal ChatGPT account.
| Vendor | OpenAI |
|---|---|
| Category | General assistant |
| Our tier verdict | Limited — Personal consumer accounts sit outside company control — fine for public-information tasks, never for client or regulated data. |
| Trains on your data? | Depends on plan / settings. On free consumer accounts, OpenAI may use your conversations to train its models unless you turn this off in Data Controls. The default favors OpenAI, not your company. |
| Data retention | Conversations are stored until the user deletes them; OpenAI states deleted chats are scheduled for permanent deletion within about 30 days, unless legally required to keep them. |
| Admin controls | None. Free accounts are personal accounts — your IT team cannot see, manage, or offboard them. |
| Compliance certifications | Not publicly documented |
| HIPAA / BAA | No. OpenAI does not offer a HIPAA Business Associate Agreement for free consumer ChatGPT accounts. |
On free consumer accounts, OpenAI may use your conversations to train its models unless you turn this off in Data Controls. The default favors OpenAI, not your company.
Retention: Conversations are stored until the user deletes them; OpenAI states deleted chats are scheduled for permanent deletion within about 30 days, unless legally required to keep them.
No. OpenAI does not offer a HIPAA Business Associate Agreement for free consumer ChatGPT accounts. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — regardless of how good the vendor’s general security posture is.
HIPAA is the gate: No. OpenAI does not offer a HIPAA Business Associate Agreement for free consumer ChatGPT accounts. Until a BAA is confirmed in writing, treat ChatGPT (free) as off-limits for anything containing PHI — patient names, appointment details, clinical notes, even "anonymized" summaries that could be re-identified.
For SEC/FINRA-regulated firms the questions are recordkeeping and confidentiality: can communications through ChatGPT (free) be captured for books-and-records requirements, and do the data terms hold up in vendor due diligence? None. Free accounts are personal accounts — your IT team cannot see, manage, or offboard them.
The privilege question comes first: entering client-confidential facts into any third-party AI service must be evaluated as a potential disclosure. Because training/retention on ChatGPT (free) depends on account type and settings, assume client matter data is off-limits unless your firm controls the account and has verified the terms.
Why the tier verdict is "generic": Limited is the right starting classification for most 50–500 person companies — but a healthcare company, a law firm, and a SaaS startup should not have identical tool lists. The $79 policy kit classifies ChatGPT (free) and 24+ other tools specifically for your industry, company size, and the data your team handles.
And it goes stale: vendor data policies change quietly — a terms update can move a tool between tiers overnight. The $149/mo Monitor plan exists precisely because this page is only accurate as of July 2026.
ChatGPT (free) can be used at work only under specific conditions. Our verdict for a typical 50–500 person company handling client or regulated data: Limited. Personal consumer accounts sit outside company control — fine for public-information tasks, never for client or regulated data. This is the single most common shadow-AI channel: an employee pasting work content into a personal ChatGPT account.
On free consumer accounts, OpenAI may use your conversations to train its models unless you turn this off in Data Controls. The default favors OpenAI, not your company.
No. OpenAI does not offer a HIPAA Business Associate Agreement for free consumer ChatGPT accounts. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — regardless of how good the vendor’s general security posture is.
We classify ChatGPT (free) as Limited for a typical 50–500 person company. Personal consumer accounts sit outside company control — fine for public-information tasks, never for client or regulated data. Your own classification should reflect your industry, data types, and which plan/account type your company actually uses.
A 4-document AI policy kit — acceptable use policy, tool tier list, acknowledgment form, manager FAQ — that classifies ChatGPT (free) and 24+ other tools for your company, industry, and data. Generated in about 10 minutes.
Generate my policy kit →We re-check vendor terms monthly and alert you when ChatGPT (free)’s data policy changes — plus regenerate your whole kit so it never goes stale. This directory is a snapshot — Monitor is the live feed.
See Monitor plan →Already have an AI policy? Check it for gaps in 30 seconds →