Does Pasting Company Data Into ChatGPT Break Your NDA?

It can be. Pasting client files, source code, or other confidential data into consumer ChatGPT does not automatically break your NDA or trade-secret law. But it can. The risk turns on two things: what account you are using and how your NDA is worded.

Business tiers (Team, Enterprise, API) are not trained on by default. Consumer ChatGPT is trained on by default unless you switch that off.

Does pasting company data into ChatGPT break my NDA?

An NDA is a private contract. Whether a paste breaks it depends on the wording, not on how you feel about it. Most NDAs say you will not disclose confidential information to a third party without permission.

When you paste a client file into a service, that service is a third party. So the first question is simple: does your NDA allow you to share the information with an outside vendor? Many do, but only vendors the company has approved.

If your employer approved a business ChatGPT account, using it is likely fine. If you paste the same file into your personal free account, you may have disclosed confidential information to an unapproved third party, which is the exact thing the NDA told you not to do.

This is also a job question, not only a lawsuit question. Breaking an NDA is usually enough to get fired for cause, long before anyone files anything in court.

Can it trigger a trade-secret claim under the DTSA?

Yes, in the wrong setup. The Defend Trade Secrets Act (DTSA) is law in force in the United States, not a proposal. It lets the owner of a trade secret bring a civil action if the secret relates to a product or service used in interstate or foreign commerce.

The statute says: "An owner of a trade secret that is misappropriated may bring a civil action under this subsection." That owner is usually the company, not you.

Two parts of the DTSA matter for pasting. First, information only counts as a trade secret if the owner "has taken reasonable measures to keep such information secret." Feeding it into a service that may train on it can undermine that.

Second, "misappropriation" includes disclosure by someone who had a duty to keep the information secret, and improper means "includes breach or inducement of a breach of a duty to maintain secrecy."

An NDA or an employee duty is that kind of duty. So a paste that breaks your confidentiality duty can line up with the statute's own words.

Two honest caveats. The company usually has to show real harm, and secrets pasted into a business tier that does not train on the data are far less exposed than the same secret dropped into a personal account.

Sources: 18 U.S.C. § 1836 | 18 U.S.C. § 1839

What is the difference between consumer and business ChatGPT data terms?

This is the whole ballgame, and most people never check which side of the line they are on. Call it the two-account line.

Consumer ChatGPT (Free, Plus, Pro): By OpenAI's own terms, the "Improve the model for everyone" setting is on by default. That means your chats can be used to train future models unless you turn it off.
Business ChatGPT (Team, Enterprise) and the API: OpenAI states it does not train on inputs or outputs from these products by default, and that you keep your rights in the inputs you provide and own the output you get back, to the extent the law allows.

So the same paragraph of client code carries very different risk depending on where you paste it. On a personal free account with the default setting, it can flow into training. On an enterprise account, it does not by default.

If you are not sure which one you are logged into, stop and check before you paste.

Who owns what comes out is a separate question, and it changes your risk too.

Sources: OpenAI Enterprise Privacy | OpenAI: how your data is used | OpenAI: disable model training

What settings keep you employed and un-sued?

Three moves cover most of the risk.

Use an approved business account for anything work-related. If your employer has a Team, Enterprise, or API setup, use that and only that for company data. The no-training default is the point.
On any personal account, turn off training. Go to Settings, then Data Controls, then switch off "Improve the model for everyone." OpenAI says this stops new conversations from being used to train. Note the limit: it applies to future chats only, so anything already used in a completed training run cannot be pulled back out for one person.
Ask before you paste anything covered by an NDA. A 30-second message to your manager or client is cheaper than a termination or a lawsuit. Get the approved-vendor list in writing.

One more that people forget: your employer can require the business tool and forbid the personal one.

Quick checklist before you paste

Which account am I in, consumer or business?
Is training off, or is the default still on?
Does my NDA name approved vendors, and is this one of them?
Would I be comfortable if the client saw this exact paste?

If any answer is a shrug, do not paste yet.

If you want your team's AI use set up so this is not a coin flip, that is the kind of thing we sort out at nomadtechnologist.com.

Not legal, financial, or tax advice.