Can Employees Use ChatGPT and AI at Work? Privacy, Copyright and Company Risks

Last materially reviewed: September 3, 2026

Direct Answer

Employees in the Philippines can generally use ChatGPT and other generative AI tools at work if their employer allows it, but using AI does not remove existing duties involving confidentiality, data privacy, intellectual property, cybersecurity, accuracy, professional responsibility, and compliance with company policy. The biggest practical risk is usually not the AI tool itself—it is what the employee puts into it and how the output is used.

Primary authorities: National Privacy Commission — Data Privacy Act IRR and IPOPHL copyright guidance.

Key Takeaways

• There is no general Philippine law that automatically bans employees from using ChatGPT at work.
• Employees should not paste confidential company data, customer records, passwords, source code, trade secrets, or sensitive personal information into an AI tool unless the company has expressly approved the tool and the use case.
• The Data Privacy Act continues to apply when personal data is processed through an AI service.
• AI-generated output can contain errors, fabricated facts, biased recommendations, or material that resembles protected works.
• Copyright protection in the Philippines is built around human authorship; purely AI-generated output should not be assumed to carry the same copyright protection as human-created work.
• Employers should publish a clear AI acceptable-use policy rather than relying on informal instructions.

Jump to a Section

1. When AI use is usually acceptable
2. Privacy and confidential data
3. Copyright and ownership
4. Cybersecurity risks
5. Employer monitoring
6. What an AI workplace policy should cover

When Is ChatGPT Use at Work Usually Acceptable?

Low-risk uses are usually those that do not expose restricted information and where a human still reviews the result. Examples may include brainstorming generic ideas, rewriting non-confidential text, creating outlines, summarizing public information, drafting internal templates, or helping explain technical concepts.

Higher-risk uses include uploading customer databases, employment records, medical information, unreleased financial results, legal advice, source code, credentials, unpublished product plans, confidential contracts, or any material covered by a non-disclosure obligation.

Decision Snapshot

Can Employees Put Personal Data Into ChatGPT?

Only with care. If an employee inputs information about customers, employees, applicants, patients, users, or other identifiable people, the organization may be processing personal data through a third-party AI provider. That processing still has to comply with the Data Privacy Act of 2012.

Organizations should ask whether the processing has a lawful basis, whether the data is necessary for the task, whether the AI provider acts as a processor or independent controller in the relevant context, whether cross-border transfers are involved, how long inputs are retained, whether the data may be used for model improvement, and what security safeguards apply.

The National Privacy Commission has repeatedly emphasized accountability, proportionality, transparency, and security in workplace data processing. Its 2026 AI-related guidance also reinforces that AI processing involving identifiable people remains subject to Philippine privacy law.

For the broader framework, see Data Privacy Compliance Checklist for Philippine Businesses and AI Law in the Philippines.

Who Owns AI-Generated Work?

Employees should not assume that every AI-generated output is automatically protected by copyright or that the employer automatically owns every part of it. Philippine copyright law traditionally protects original works of human authorship. IPOPHL has publicly explained that purely AI-generated works are not protected under the current copyright regime because authorship is tied to natural persons; where a work combines AI and human creation, protection may attach only to the human-created portions.

For employment-created works, ordinary employment and contract rules can also affect ownership. Company contracts, invention-assignment clauses, creative-service agreements, and client agreements should therefore be reviewed alongside copyright law.

There is also an infringement risk. An AI tool may produce text, images, code, or designs that resemble existing protected material. Employees should not treat generated output as automatically cleared for commercial use.

What Are the Cybersecurity Risks?

• Data leakage: confidential information can leave the company environment.
• Prompt injection: malicious instructions embedded in documents or websites can manipulate AI systems.
• Hallucinations: AI can confidently generate false facts, citations, calculations, or legal claims.
• Credential exposure: employees may accidentally paste API keys, passwords, tokens, or internal URLs.
• Shadow AI: employees may use unapproved tools outside corporate security controls.
• Malicious code: AI-generated scripts can contain vulnerabilities or unsafe dependencies.

Employers should treat AI tools like any other external SaaS provider: approve tools, assess vendors, control data access, define permitted use, and log or review high-risk workflows where appropriate.

Can Employers Monitor Employee AI Use?

Potentially, yes, particularly on company-owned devices and systems, but monitoring still has privacy limits. NPC guidance on workplace monitoring emphasizes lawful processing, transparency, necessity, proportionality, and less intrusive alternatives. Employers should tell workers what is being monitored, why it is necessary, and how collected data will be used.

Extreme or continuous monitoring should not be treated as automatically justified merely because AI tools are involved.

What Should a Workplace AI Policy Cover?

A practical AI acceptable-use policy should answer at least these questions:

• Which AI tools are approved?
• What types of data are prohibited from being entered?
• Can personal data be used, and under what safeguards?
• Which tasks require manager, legal, privacy, IT, or security approval?
• When must an employee disclose that AI assisted with the work?
• What human review is required before publication or decision-making?
• How should copyrighted, licensed, confidential, or client-owned material be handled?
• Can generated code be deployed without security review?
• What records should be kept for high-risk AI use?
• What happens if an employee violates the policy?

Recommended Employee Rule

A simple working rule is: if you would not send the information to an unknown external vendor by email, do not paste it into an unapproved AI tool.

Frequently Asked Questions

Can my employer ban ChatGPT at work?

Yes. Employers can generally set reasonable rules for company systems, confidential information, work methods, and security, subject to applicable labor, privacy, contractual, and other legal limits.

Can I use ChatGPT to write work emails?

Usually this is lower risk if the email contains no confidential or sensitive information and the employer permits the tool. The employee should still review the output for accuracy, tone, and unintended disclosure.

Can I paste customer data into ChatGPT?

Not safely by default. Personal data should only be processed through an AI tool when the organization has assessed the legal basis, vendor terms, security, retention, transfer, and privacy risks and has authorized the use.

Can AI-generated work be copyrighted in the Philippines?

Purely AI-generated output should not be assumed to qualify for copyright protection. IPOPHL has stated that the current framework is based on human authorship, while human-created portions of AI-assisted works may still be protected.

Who is responsible if AI gives a wrong answer?

Using AI does not automatically shift responsibility to the tool provider. Employees and organizations remain responsible for decisions, representations, professional work, and compliance obligations arising from how AI output is used.

Official Sources

• National Privacy Commission — Data Privacy Act IRR
• National Privacy Commission — Workplace Monitoring Guidance
• National Privacy Commission — Responsible AI Governance, 2026
• IPOPHL — Copyright FAQs
• IPOPHL — AI and Intellectual Property, 2026