Chatbot memory can store personal data from your staff
In brief
Researchers including Abhisek Dash at the Max Planck Institute for Software Systems studied ChatGPT memory. In February 2026 they analysed 1,058 conversations and 22,971 exchanges. They report that 91 percent of users had personal data stored in memory, and 54 percent had sensitive data under GDPR.
Source : Next - « La mémoire des chatbots IA crée des autoportraits algorithmiques des utilisateurs »
What it changes for an SME
If your staff use ChatGPT with memory enabled, personal and sometimes sensitive data can be stored. In the February 2026 sample, 96 percent of memory updates were triggered by the system, not by the user. For an SME, GDPR risk rises as soon as customer or employee information appears in those chats. OpenAI has changed this memory since June, synthesising information on an ongoing basis; the researchers still see open questions on data sensitivity and user control.
What you can do
- Check whether memory is turned on for any ChatGPT accounts used at work.
- Tell staff in writing not to paste customer, employee or health data into these tools.
- Record chatbot use in your processing register and in internal rules.
Let's talk about the time you could save.
In 20 minutes, we find where AI could save you time or money. Free, no commitment.