30 Days Gen AI Risk Trial -Start Now
Skip to main content

ChatGPT DLP

  • ChatGPT

ChatGPT DLP for prompts and files.

ChatGPT DLP checks sensitive employee prompts and files before submission. Evaluate Aona's blocking or redaction on the account and managed client you use.

Synthetic example01

A support prompt with a customer identifier

ChatGPT browser prompt · synthetic customer data

Original input
Summarise the escalation for Northstar, account NS-48217. Keep the requested next steps.

Illustrated rule: redact customer and account identifiers before a supported submission.

An illustration, not an installed-product test or a coverage guarantee.

Account. Surface. Action.

01Account
Personal, Business or Enterprise: record the signed-in account.
02Employee surface
Browser and native desktop are separate client paths.
03Data action
Test typed prompts, pasted text and file uploads separately.

Provider and existing-stack controls

Start with the controls you already have.

OpenAI says ChatGPT Business and Enterprise inputs and outputs are not used to train its models by default. That data-handling commitment is separate from deciding what employees may submit. Purview's ChatGPT Enterprise connector supports audit and compliance features; its capability table marks DLP as unsupported for that connector. Separate Purview browser and endpoint paths offer DLP for supported AI sites. Check the route and prerequisites, not just the licence name.

Provider documentation checked 2 November 2026. Availability and entitlement still need confirmation.

Make the outcome reviewable.

Get the acceptance checklist (PDF)
  1. 01

    Record the ChatGPT account, browser or app, installed client version and existing controls.

  2. 02

    Test a restricted and an allowed input with synthetic data. Repeat separately for a typed prompt, paste and file upload.

  3. 03

    Compare the expected block or redaction with the employee response, protected content and available policy event.

The details that change the decision.

What is ChatGPT DLP?

ChatGPT data loss prevention inspects employee prompts or files and applies a policy to sensitive content before submission. Aona can block or redact supported inputs through its installed browser plugin or native app. Confirm the account, client and input path in your evaluation; account access and model-training settings are separate controls.

Can we block personal ChatGPT accounts while allowing a business workspace?

Account access and content inspection are separate requirements. Confirm your identity, browser and workspace controls first. This page does not claim a verified Aona restriction that distinguishes every personal and business account.

Does a ChatGPT Business or Enterprise account remove the need for DLP?

OpenAI states that it does not train on ChatGPT Business or Enterprise inputs and outputs by default. Your organisation still decides which information employees may submit. Check the provider agreement and workspace settings, then test any required pre-submission content control on the actual account and client.

What should we test for a file upload?

Name the upload route, file format and expected response. For a supported DOCX, XLSX or PDF redaction path, inspect the returned file, layout and any unsupported content separately from the prompt test.

How should we compare Aona with existing Purview or network controls?

Start with your licensed product, managed browser or endpoint and routed traffic. Compare the same synthetic action and required evidence. A network or provider control is not absent simply because the application is ChatGPT.

What must be installed before an Aona evaluation?

The Aona browser plugin supports Chrome, Edge, Firefox and Safari. Confirm the intended browser, application and input path; browser support does not establish feature parity. IT teams can deploy the Aona endpoint app on Windows and macOS with their preferred software deployment tools. Intune is one option; direct installation is also available on both platforms.

Review your ChatGPT data-protection path.

Bring the ChatGPT account, managed client and one synthetic prompt or file. Review the expected policy response, employee experience and evidence before rollout.

  1. Account and managed client
  2. Prompt or file policy response
  3. Existing controls, evidence and rollout