AI Adoption: How ChatGPT Is Getting Employees' Corporate Data

When companies adopt AI services, employees send corporate data to ChatGPT and other public platforms, risking leaks. Solar Group's analysis showed that the volume of such data grew 30-fold in a year.

What exactly ends up in other people's data centers

The pattern is simple: you need a summary of a contract, so you upload it to ChatGPT. You need to process a client list, so you paste it into a spreadsheet with AI functions. The result is good and it takes less time. The problem is that along with the documents, the following goes to a third-party data center:

• Full names of employees and clients
• Passport details and INN (taxpayer ID)
• Bank details and deal amounts
• Commercial terms and internal correspondence
• Information that constitutes a trade secret

The service usually shows no warnings. Formally, the user has accepted terms stating that data may be used to train the model, but few people read them.

Where the real risk is, and where it is scaremongering

Major AI providers state that they do not use corporate data sent through API mode to train their models. But for Russian companies this does not solve the problem.

"About 60% of companies have no internal rules on this at all: the process is controlled neither technically nor on paper," according to the

Solar Group study.

The real risks fall into three areas.

Regulatory. Under Russian Federal Law 152-FZ "On Personal Data", transferring personal data to third parties without the data subject's consent and without a proper contract is a violation. Since May 30, 2025, fines for repeat violations by legal entities reach 15 million rubles.

Commercial. If a client contract includes a confidentiality clause and an employee sends the document to ChatGPT, the company has breached its contractual obligation. The counterparty is entitled to demand compensation for losses.

Reputational. A leak of partners' data through careless use of AI becomes grounds for terminating contracts.

What companies should do right now

The good news: solutions exist, and they do not require banning AI.

The first step is an internal policy: a one-page document listing which data may be processed in external AI services and which may not. Without it, the company has no basis for disciplinary action and no argument in a conversation with the regulator.

The second step is employee training. Don't ban, explain: what counts as personal data and trade secrets, why they must not be uploaded to a public service, and what corporate alternatives exist.

The third step is technical measures: DLP systems that block or log the transfer of certain categories of data outside the perimeter; and corporate AI tools running on the company's own infrastructure or in a Russian cloud with a provider that has signed a processing agreement under 152-FZ.

What this means

Employees' mass shift to AI tools cannot be stopped, and it doesn't need to be. But a 30-fold rise in the volume of transferred data in a single year suggests that most companies missed the moment when this stopped being a personal initiative and became a systemic corporate risk. Rules are needed not "someday" but right now.

Frequently asked questions

Can a company be fined if an employee uploaded data to

ChatGPT on their own?

Yes, potentially. Under 152-FZ, responsibility for processing personal data lies with the operator, meaning the company, not the individual employee. If the transfer of personal data to a third party is established, the regulator may fine the legal entity. Since May 30, 2025, the fine for repeat violations reaches 15 million rubles.

Is there a safe alternative to public AI services?

Yes: corporate AI solutions deployed on the company's own servers or in a Russian cloud with a provider that has signed a personal data processing agreement. In that case, data does not leave the controlled perimeter.

What data do employees send to ChatGPT?

According to the study, it includes employees' full names, information from corporate contracts, client details and other confidential documents that employees upload for AI services to process.

Why do companies risk sending data to AI?

The study found that about 60% of Russian companies have no internal rules on this. Employees send data to ChatGPT because it speeds up work: they can summarize a contract, process a client list or do other tasks faster than by hand.