Can Employees Use ChatGPT and AI at Work? Privacy, Copyright and Company Risks

Last materially reviewed: September 3, 2026

Direct Answer

Employees in the Philippines can generally use ChatGPT and other generative AI tools at work if their employer allows it, but using AI does not remove existing duties involving confidentiality, data privacy, intellectual property, cybersecurity, accuracy, professional responsibility, and compliance with company policy. The biggest practical risk is usually not the AI tool itself—it is what the employee puts into it and how the output is used.

For the wider Philippine framework on AI law, privacy, governance, deepfakes and AI security, see the AI & Emerging Technology hub.

Primary authorities: National Privacy Commission — Data Privacy Act IRR and IPOPHL copyright guidance. For authorship and ownership questions involving AI output, see Cybercode’s AI-Generated Works & Copyright Philippines hub.

Key Takeaways

• There is no general Philippine law that automatically bans employees from using ChatGPT at work.
• Employees should not paste confidential company data, customer records, passwords, source code, trade secrets, or sensitive personal information into an AI tool unless the company has expressly approved the tool and the use case.
• The Data Privacy Act continues to apply when personal data is processed through an AI service.
• AI-generated output can contain errors, fabricated facts, biased recommendations, or material that resembles protected works.
• Copyright protection in the Philippines is built around human authorship; purely AI-generated output should not be assumed to carry the same copyright protection as human-created work.
• Employers should publish a clear AI acceptable-use policy rather than relying on informal instructions.

Jump to a Section

1. When AI use is usually acceptable
2. Privacy and confidential data
3. Copyright and ownership
4. Cybersecurity risks
5. Employer monitoring
6. What an AI workplace policy should cover

When Is ChatGPT Use at Work Usually Acceptable?

Low-risk uses are usually those that do not expose restricted information and where a human still reviews the result. Examples may include brainstorming generic ideas, rewriting non-confidential text, creating outlines, summarizing public information, drafting internal templates, or helping explain technical concepts.

Higher-risk uses include uploading customer databases, employment records, medical information, unreleased financial results, legal advice, source code, credentials, unpublished product plans, confidential contracts, or any material covered by an employee non-disclosure obligation.

Decision Snapshot

Can I Put Confidential Work Data Into My Personal AI Account?

Do not upload it unless your organization has expressly approved that account, the tool and the particular data use. A personal subscription, a manager’s casual suggestion to “use AI,” or a privacy toggle does not establish permission to disclose company or client information. If the approval is unclear, pause the upload and ask the responsible manager, IT/security team or data protection officer.

Check Three Separate Questions Before Uploading

1. Permission: Does the company policy permit this task in this exact account or workspace? Check restrictions in client agreements and confidentiality commitments too. An approved product name does not necessarily mean your personal account is approved.
2. Data: What is the minimum information the task needs? Prefer public material or a fictional example where these will work. Removing names alone may leave people identifiable through dates, roles, transaction details or combinations of facts. The Data Privacy Act IRR, section 3(l), covers information that can identify someone when combined with other information; sections 18, 21–22 and 25 address proportionality, lawful processing and security.
3. Provider controls: Have the authorized reviewers checked retention, training, access and any connected services for this account? Record the approved settings and permitted data categories instead of assuming that every plan has the same protections.

What ChatGPT Privacy Settings Do—and Do Not—Resolve

According to OpenAI’s current data-controls documentation, switching off model improvement prevents new conversations from being used for training, but does not delete saved chats. Temporary chats are not used for model improvement while they remain temporary and may be retained for up to 30 days for safety. Submitting feedback can allow the associated conversation to be used for training. These are provider controls, not your employer’s authorization or a finding that a proposed disclosure complies with Philippine law.

Copyable Approval Request

I want to use [tool and exact account/workspace] for [task]. The proposed input contains [data categories, without attaching the confidential material]. Could you confirm whether this use is approved, what must be removed, which settings or approved workspace I must use, and who should review the output? If it is not approved, may I use [public material or a fictional example] instead?

If information was already uploaded: stop further uploads and promptly tell your organization’s designated privacy or security contact what was shared, when, and through which account. Follow its incident-handling process; do not assume deleting the chat completes that process.

Sources rechecked for this personal-account section: October 17, 2026. The approval request is an editorial working aid, not an official form or a substitute for your organization’s policy.

Can Employees Put Personal Data Into ChatGPT?

Only with care. If an employee inputs information about customers, employees, applicants, patients, users, or other identifiable people, the organization may be processing personal data through a third-party AI provider. That processing still has to comply with the Data Privacy Act of 2012.

Organizations should ask whether the processing has a lawful basis, whether the data is necessary for the task, whether the AI provider acts as a processor or independent controller in the relevant context, whether cross-border transfers are involved, how long inputs are retained, whether the data may be used for model improvement, and what security safeguards apply.

The National Privacy Commission has repeatedly emphasized accountability, proportionality, transparency, and security in workplace data processing. Its 2026 AI-related guidance also reinforces that AI processing involving identifiable people remains subject to Philippine privacy law.

For the broader framework, see Data Privacy Compliance Checklist for Philippine Businesses and AI Law in the Philippines. If your team is considering a local multi-model workspace, see our review of Smart’s AI.Smart packs, limits and privacy questions.

Who Owns AI-Generated Work?

Employees should not assume that every AI-generated output is automatically protected by copyright or that the employer automatically owns every part of it. Philippine copyright law traditionally protects original works of human authorship. IPOPHL has publicly explained that purely AI-generated works are not protected under the current copyright regime because authorship is tied to natural persons; where a work combines AI and human creation, protection may attach only to the human-created portions.

For employment-created works, ordinary employment and contract rules can also affect ownership. Company contracts, invention-assignment clauses, creative-service agreements, and client agreements should therefore be reviewed alongside copyright law.

There is also an infringement risk. An AI tool may produce text, images, code, or designs that resemble existing protected material. Employees should not treat generated output as automatically cleared for commercial use.

What Are the Cybersecurity Risks?

• Data leakage: confidential information can leave the company environment.
• Prompt injection: malicious instructions embedded in documents or websites can manipulate AI systems.
• Hallucinations: AI can confidently generate false facts, citations, calculations, or legal claims.
• Credential exposure: employees may accidentally paste API keys, passwords, tokens, or internal URLs.
• Shadow AI: employees may use unapproved tools outside corporate security controls.
• Malicious code: AI-generated scripts can contain vulnerabilities or unsafe dependencies.

Employers should treat AI tools like any other external SaaS provider: approve tools, assess vendors, control data access, define permitted use, and log or review high-risk workflows where appropriate.

Can Employers Monitor Employee AI Use?

Potentially, yes, particularly on company-owned devices and systems, but monitoring still has privacy limits. NPC guidance on workplace monitoring emphasizes lawful processing, transparency, necessity, proportionality, and less intrusive alternatives. Employers should tell workers what is being monitored, why it is necessary, and how collected data will be used.

Extreme or continuous monitoring should not be treated as automatically justified merely because AI tools are involved.

What Should a Workplace AI Policy Cover?

A practical AI acceptable-use policy should answer at least these questions:

• Which AI tools are approved?
• What types of data are prohibited from being entered?
• Can personal data be used, and under what safeguards?
• Which tasks require manager, legal, privacy, IT, or security approval?
• When must an employee disclose that AI assisted with the work?
• What human review is required before publication or decision-making?
• How should copyrighted, licensed, confidential, or client-owned material be handled?
• Can generated code be deployed without security review?
• What records should be kept for high-risk AI use?
• What happens if an employee violates the policy?

Recommended Employee Rule

A simple working rule is: if you would not send the information to an unknown external vendor by email, do not paste it into an unapproved AI tool.

Frequently Asked Questions

Can my employer ban ChatGPT at work?

Yes. Employers can generally set reasonable rules for company systems, confidential information, work methods, and security, subject to applicable labor, privacy, contractual, and other legal limits.

Can I use ChatGPT to write work emails?

Usually this is lower risk if the email contains no confidential or sensitive information and the employer permits the tool. The employee should still review the output for accuracy, tone, and unintended disclosure.

Can I paste customer data into ChatGPT?

Not safely by default. Personal data should only be processed through an AI tool when the organization has assessed the legal basis, vendor terms, security, retention, transfer, and privacy risks and has authorized the use.

Can AI-generated work be copyrighted in the Philippines?

Purely AI-generated output should not be assumed to qualify for copyright protection. IPOPHL has stated that the current framework is based on human authorship, while human-created portions of AI-assisted works may still be protected.

Who is responsible if AI gives a wrong answer?

Using AI does not automatically shift responsibility to the tool provider. Employees and organizations remain responsible for decisions, representations, professional work, and compliance obligations arising from how AI output is used.

Official Sources

• National Privacy Commission — Data Privacy Act IRR
• National Privacy Commission — Workplace Monitoring Guidance
• National Privacy Commission — Responsible AI Governance, 2026
• IPOPHL — Copyright FAQs
• IPOPHL — AI and Intellectual Property, 2026

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.