Pasting company documents into ChatGPT. Is it already a trade secret leak?
Author: Andrzej Albera, Responsible for strategy and the company's direction
The situation. It is Thursday, 4:30 pm. A salesperson has to prepare an offer for a large client by tomorrow. He pastes the previous contract, the price list with discounts and the list of the client's contact people into ChatGPT. Two minutes later he has a well-written document. Nobody asked where the contract, the discounts and the names ended up.
What the law says
- A trade secret, under Article 11(2) of the Polish Act on Combating Unfair Competition, is information that has economic value, is not generally known and is protected by the company with reasonable measures. A contract with discounts, a client list or financial data usually meet these conditions.
- Pasting them into an external tool may be regarded as disclosure to a third party. Lawyers are still debating it, but the risk is real.
- An employee must keep confidential any information whose disclosure could harm the employer (Article 100 § 2(4) of the Polish Labour Code). He faces liability for damages and, in extreme cases, dismissal without notice.
- Serious damage makes it a criminal matter: Article 23 of the Act on Combating Unfair Competition provides for a fine, restriction of liberty or up to 2 years in prison.
- A client list is personal data. Passing it to a provider without a data processing agreement, often outside the EU, breaches the GDPR. If the breach poses a risk to those people, the company has 72 hours to report it to the Polish data protection authority (UODO). Read more about AI and personal data on our page Shadow AI.
- The paradox. A company without an AI policy may find it hard to prove that it protected its secrets with “reasonable measures”. It then loses part of its legal protection.
What to do
- Decide what is secret. Three groups are enough: public, internal and confidential information. Contracts, price lists with discounts, client data, financial data and code are confidential. Every employee should know which group the document in their hands belongs to.
- Write down what may and may not be pasted. One page, plain language, examples from the company's daily work. You can start with our AI use policy template. Only written rules are evidence of “reasonable measures”.
- Give people a tool where confidential documents can be worked on. A policy on paper is not enough, because nobody enforces it. You need a tool that works inside the company, controls what goes outside and records who used what.
This is how our SAIE ecosystem works. TWIN:DESK is a Digital AI Desk where a contract or a price list is analysed by a model running on the company's own servers, so the document never leaves the building. PROXY:AI checks every query to an external model and lets through only what the company's rules allow. The CDF methodology starts by assessing which data may go where.
Frequently asked questions
Does the paid version of ChatGPT solve the problem?
Partly. In business plans the provider does not train models on customer data by default. Documents still go to an external company's servers, though, and personal data requires a data processing agreement and a check of where the data is processed. We compare the options on our page ChatGPT Enterprise, Copilot or your own AI environment.
Is it enough to switch off training on my conversations in the settings?
No. It is an important setting, but the conversation is still stored on the provider's servers. Training is one thing, storage is another.
Do such leaks really happen?
Yes. In 2023 Samsung engineers pasted confidential source code into ChatGPT, and the company banned staff from using public AI tools. In 2025 conversations that users had shared via a link appeared in Google search results until OpenAI withdrew the feature.
An employee has already pasted client data. What now?
Delete the conversation, record the incident in the breach register and assess the risk to the people concerned. If there is a risk, the company has 72 hours to report it to UODO. Then it is worth asking why the employee did not have a better tool.
Wouldn't it be simpler to ban AI at work?
A ban only hides the problem. According to a KPMG study, 54% of working Poles use AI at work, and 55% of them do not tell their employer. We wrote more about it in AI inspections and fines from 28 October.
The opportunity
People who paste documents into a chat want to work faster and better. That is good news for the company. Give them a tool where confidential documents can be worked on safely, and the same energy turns from a risk into an advantage.