Generative AI at work: data protection in Switzerland

ChatGPT, Microsoft Copilot or Gemini: your employees are probably already using generative AI to draft an e-mail, summarize a document or translate a text. Often with a free personal account, without knowing what happens to the information they enter. Generative AI in business therefore raises a concrete data protection question, in Switzerland as elsewhere.

Banning it does not work for long. Setting a framework is more realistic: choose the tools, decide what may be entered and explain it to your teams.

Does the nFADP apply to artificial intelligence?

Yes. The FDPIC has pointed out that the data protection act, in force since September 1, 2023, applies directly to AI-based data processing, without waiting for a specific law. Entering personal data into an AI tool is processing: the usual principles apply, namely purpose limitation, proportionality, security and transparency.

Depending on the plan, the tool's vendor processes this data on your behalf or for its own purposes. Its servers are often outside Switzerland, so the question of disclosing data abroad arises too.

Personal account or work account: what is the difference?

Consumer and business plans do not come with the same terms. Depending on the plan and settings, a free version may use conversations to improve its models, and the company has no visibility over accounts created by its employees.

Business plans, for example Microsoft 365 Copilot or Copilot Chat used with an Entra ID work account, generally provide that the data entered is not used to train the models, and tie accounts to the company: creation, deactivation when an employee leaves, logging. Still, read the terms of the plan you choose.

What data should you not enter into ChatGPT or Copilot?

The level of caution depends on how sensitive the data is. A simple rule: enter nothing you would not e-mail to an outside party with no contract in place.

• Passwords, access keys and sign-in codes.
• Sensitive data as defined by the nFADP, such as health data.
• Information covered by professional secrecy or a confidentiality agreement.
• Customers' financial data: bank details, payment status.
• Unpublished strategic documents: quotes, contracts, acquisition plans.

Writing an AI usage policy for your business

A policy of one or two pages is enough. It states which tools are approved and with which accounts, which data is excluded, and reminds staff that output must be reviewed by a person: AI can make up facts, figures or references.

It also covers transparency: if your customers interact with a chatbot, they must know they are dealing with a machine. Add what to do in case of a mistake, for example data entered by accident. Present the policy in a short session rather than a simple e-mail, and revise it as the tools change.

Data protection and generative AI: the technical side

A few settings support the policy: work accounts managed in Entra ID, access rights reviewed before enabling Copilot (it sees everything the user can see) and, where needed, blocking unapproved tools or applying sensitivity labels to confidential documents.

These settings do not replace the policy: they reduce mistakes without covering every use. Staff awareness remains the first lever.