What Not to Share With ChatGPT at Work: UAE Guide 2026
Pasting the wrong thing into ChatGPT can breach your confidentiality duties under UAE law. This guide lists what to keep out, explains the rules in plain English, and shows how to get the same help using placeholders and safer prompts.
October 22, 2026
Don't paste anything into ChatGPT, or any other AI assistant, unless your employer has approved that tool for that kind of information. In practice, that means keeping out personal data about anyone, confidential client or company information, passwords and keys, and HR or legal records. You can still get most of the help you want: ask for a structure, a template or a method, and swap real names and numbers for placeholders.
The rule matters more in the UAE than many people assume. Your contract isn't the only thing asking you to keep work information private: the UAE Labour Law does too, and personal data falls under federal data protection law. This guide covers what to keep out, why, and how to get the same result safely.
This is general guidance, not legal advice. Your employer's AI policy comes first. If it says something different, follow the policy and ask.
What not to share with ChatGPT: 10 things to keep out of public AI tools
| # | Keep out | Examples | Do this instead |
|---|---|---|---|
| 1 | Passwords, keys and access codes | System logins, API keys, Wi-Fi passwords, one-time codes | Never paste them. Ask how to do the task without including the credential. |
| 2 | Personal data about customers or colleagues | Names with phone numbers, Emirates ID or passport numbers, home addresses, salaries | Use roles and invented values ("Customer A", "050 000 0000"). |
| 3 | HR records | CVs, performance reviews, disciplinary notes, sick notes, exit interviews | Remove anything that identifies the person, or use your company's approved HR tool. |
| 4 | Client confidential information | Client briefs, contracts, anything under an NDA | Describe the task in general terms and ask for a template. |
| 5 | Unpublished financial information | Results before release, pricing, budgets, deal terms, board papers | Use made-up figures in the same format. |
| 6 | Source code and security details | Proprietary code, system diagrams, vulnerability reports | Use your company's approved coding assistant, or a small invented example. |
| 7 | Legal matters | Disputes, legal advice, draft settlements | Ask general questions; keep specifics with your legal team. |
| 8 | Plans that aren't public | Unannounced products, campaigns, restructures, hiring plans | Ask for a generic plan or checklist. |
| 9 | Meeting recordings, transcripts and internal chats | Uploaded recordings, copied Teams, Slack or WhatsApp threads | Write a short summary of the non-sensitive points yourself, then ask AI to tidy it. |
| 10 | Data your sector regulator restricts | Patient records, bank customer data | Only in a tool your compliance team has approved for that data. |
Why it matters
What you type leaves your company's control
When you type into a chatbot, the text goes to the provider's servers, and what happens next depends on your plan. OpenAI says it does not train its models on inputs and outputs from ChatGPT Business, Enterprise, Edu or its API by default. On personal Free, Plus and Pro accounts, sharing for model training is switched on by default and you have to opt out (OpenAI Help Center).
Switching training off changes what the provider may do with your text. It doesn't stop the text reaching the provider. Copilot, Gemini and Claude each have their own settings, and they differ by plan, so check the tool you use.
Leaks have already happened
In April 2023, Samsung's semiconductor division found three cases where engineers had uploaded internal information to ChatGPT, including source code and meeting minutes (The Korea Herald, via Asia News Network). The company then restricted staff use of generative AI tools and warned that breaking its rules could lead to disciplinary action, including dismissal (MobileSyrup).
Most UAE office workers already use these tools
In a survey published by Veritas Technologies in February 2024, 92% of UAE office workers said they used publicly available generative AI tools at work. In the same survey, a third (34%) of office workers admitted entering potentially sensitive information, such as customer details, employee information and company financials. Only 47% said their employer gave mandatory guidance on use (Intelligent CIO Middle East). The figures are from early 2024, but many teams still work without written rules.
What UAE law says, in plain English
Your duty of confidentiality
Article 16 of Federal Decree-Law No. 33 of 2021, the UAE Labour Law, requires employees to keep confidential the information they gain through their work and not to disclose business secrets (Gulf News). Breaching these duties can lead to disciplinary penalties up to dismissal. Article 44 allows dismissal without notice where disclosing work secrets causes the employer industrial or intellectual property loss (Mondaq, Dr Hassan Elhais).
Whether pasting something into an AI tool counts as disclosure depends on the facts. It is a risk you don't need to take.
Personal data
The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, often called the PDPL) treats information that identifies someone directly or indirectly as personal data, including names, photographs, contact details, locations and online identifiers. Entering personal data into an AI tool is itself a form of processing under the law (Samuel Moore, BSA Law, in Communicate).
The PDPL has been in force since 2 January 2022. As of October 2026, its Executive Regulations, which set out detailed procedures and penalties, had not been published (Trustable). That is no reason to relax. The law already applies, and in June 2026 the UAE created a Federal Authority for Artificial Intelligence and Data, bringing together the AI Office, the Emirates Data Office and the digital government sector of the TDRA under one body that reports to the Cabinet (Morgan Lewis).
If you work in a free zone or a regulated sector
The UAE has separate onshore and free-zone data protection laws (Access Partnership). In the DIFC, Regulation 10, in force since September 2023, adds obligations for organisations that deploy or operate AI and other autonomous systems to process personal data (Baker Botts). Banks, insurers and healthcare providers also have their own regulators' rules. Your compliance team will know which apply to you.
Before you paste: a 5-question check
- Has my employer approved this tool for this kind of work? A personal account usually isn't approved, even if the company uses the same tool.
- Could this text identify a person, directly or indirectly? A job title plus a team name can be enough.
- Is it confidential to a client, or covered by an NDA or a contract?
- Would it hurt the company if a competitor read it?
- Can I get the same help without the real details?
If the answer to question 1 is no, or to any of questions 2 to 4 is yes, rewrite the request using question 5.
| Level | What it covers | Example |
|---|---|---|
| Green: usually fine | Public information, general questions, learning a skill, your own non-confidential writing | "Explain how a pivot table works." |
| Amber: approved tool only, details removed | Internal documents with names and figures stripped out, anonymised feedback, client emails with identifying details removed | "Improve the tone of this email to a client about a delayed delivery" (names and order details removed) |
| Red: keep out unless explicitly approved for this data | Personal data, HR records, client confidential information, credentials, unpublished financials, source code, legal matters | Pasting a candidate's CV to ask for interview questions |
How to get the same help without the risky details
1. Swap real details for placeholders
Risky:
Rewrite this feedback for Ahmed Khan in our Dubai sales team. He missed his Q3 target of AED 2.4 million by 30% and was late six times.
Safer:
Rewrite this performance feedback for a sales employee who missed a quarterly target by 30% and has been late repeatedly. Keep it firm, fair and specific, and suggest two measurable goals for next quarter. [Paste your draft with names and figures removed.]
You get the same quality of rewrite. The employee's identity and the company's numbers stay with you.
2. Ask for the structure, not the content
Instead of uploading a client's brief, ask: "Give me a proposal outline for a facilities management contract with a hotel group, including sections on scope, service levels and pricing assumptions." Fill in the real details yourself, in your company's own systems.
3. Use invented data for spreadsheet help
Build a ten-row sample with the same column headings and made-up values. Ask the AI for the formula or pivot table you need, test it on the sample, then apply it to the real file on your own machine.
4. Summarise first, polish second
Write the non-sensitive points of a meeting in your own words, then ask the AI to make them clearer. Don't upload the recording or the transcript.
5. Use your company's approved tool for amber work
If your employer provides a business AI tool, use it for internal work. Personal accounts aren't covered by your company's agreements with the provider.
Personal account or company tool: what changes
| Personal account (e.g. ChatGPT Free or Plus) | Company-approved business plan | |
|---|---|---|
| Who controls the settings | You | Your IT or admin team |
| Used to train OpenAI's models | On by default; you can switch it off | Off by default for Business, Enterprise and Edu, according to OpenAI |
| Covered by your employer's agreements and policy | No | Yes, within what the policy allows |
| Amber information | No | Only if your policy allows it |
| Red information | No | Only with explicit approval for that data |
If you use a personal ChatGPT account for anything work-related, switch off training: Settings > Data Controls > "Improve the model for everyone". OpenAI says this applies to new conversations (OpenAI Help Center). Treat it as a backstop. It doesn't make confidential work safe to paste.
Already pasted something you shouldn't have?
- If it was a password or key, change it now and tell IT.
- Delete the conversation and any shared links to it. This removes it from your history; it may not undo what the provider has already received.
- Tell your manager or data protection contact, following your company's policy. The company may need to decide whether anyone else must be informed.
- Write down what you shared, when, and in which tool.
Reporting early is better for you and for the company than hoping nobody notices.
For managers: make the safe way the easy way
Banning AI outright rarely works. A UAE legal commentary notes that a full ban may push staff to personal accounts and unapproved tools without the organisation knowing (BSA Law, in Communicate). A short policy works better:
- A list of approved tools and accounts
- A red-line list of data that never goes into AI tools
- Three risk levels (low, medium, high) with what each needs: none, human review, or approval
- Fact-checking and human review before anything is sent to a client or published
- A simple way to report mistakes without blame
- Short training so people know the rules exist and why
Learn to use AI well, and safely
If you want structured practice rather than trial and error, WeCert's AI courses cover this ground directly:
- AI Basics: What Every Professional Needs to Know is a self-paced course of about eight hours. Its modules include "Privacy, ethics & company policy" (what's safe to paste and what isn't) and "Checking AI output", and every exercise works on free versions of the tools.
- AI in Practice: Applied AI for Working Professionals applies AI to your own writing, research and reporting, and includes a "Responsible AI at work" module with a checklist.
- Certified AI Professional in HR is for HR teams. Its ethics and privacy module covers UAE data-protection basics and a red-line list for HR data.
- AI Governance & Ethics Certificate is for the people who write and enforce AI policy.
Training a team of three or more? Ask about group rates and private dates.
Frequently asked questions
Does ChatGPT use what I type to train its models?
It depends on your plan. OpenAI says business plans (Business, Enterprise, Edu) and its API are not used for training by default, while personal Free, Plus and Pro accounts are, unless you switch it off in Data Controls.
Is it illegal to use ChatGPT at work in the UAE?
The laws covered here don't ban AI tools. The legal risk comes from what you put into them, such as confidential business information or personal data, and from ignoring your employer's rules.
Is a company ChatGPT Enterprise account safe for confidential information?
It gives your company more control, and OpenAI says business data isn't used for training by default. Whether a specific kind of data is allowed is still your employer's decision, so check the policy.
If I delete a chat, is the data gone?
Deleting removes it from your history. Providers set their own retention rules, so deletion from your view doesn't necessarily mean immediate deletion from their systems. Check the provider's data retention terms.
Can I use AI with anonymised data?
Usually, if the data is properly anonymised and your policy allows it. Remember that people can be identified indirectly: a role, a team and a date together can point to one person.