ChatGPT: sensitive data

1. 01ChatGPT trains on data unless a business tier or opt-out is used. Verify which tier these users are on.
2. 024 of 5 matches were not blocked (All Full Names, U.S. Social Security Number (SSN), Credit Card Number). Review which rules still run in audit mode and align them with the blocking rules.
3. 031 person overrode the DLP warning. Read the business justifications in Activity explorer; repeated overrides for the same data type mean the policy is wrong or the training is.
4. 04High-impact information types were involved (All Full Names, U.S. Social Security Number (SSN), Credit Card Number). Treat this as a data incident: confirm with the user what was pasted, and check the vendor's retention terms for the accounts involved.

• ▲Critical85ChatGPTEntra consentall users
• ◆High51ChatGPTNetwork11 people
• ●Medium48ChatGPTEndpoint2 people
• ◆High58ChatGPTEmail4 people
• ◆High60ChatGPT via Power PlatformAzure & Power Platform3 people
• ◆High66ChatGPTSIEM · Splunk (demo)3 people
• ▲Critical81ChatGPTCode · GitHub (demo)0 people
• ●Medium38ChatGPTOkta (demo)10 people
• ●Medium30ChatGPTGoogle Workspace (demo)5 people

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

1. dlp_activity · Sep 11, 2026
   5 DLP events for ChatGPT by 3 people in 30 days: 1 blocked, 0 warned, 1 overridden, 3 audit only; types: All Full Names, U.S. Social Security Number (SSN), Credit Card Number, Azure Storage Account Key
   Detail

   {
     "domains": [
       {
         "count": 5,
         "domain": "chatgpt.com"
       }
     ],
     "byAction": {
       "warn": 0,
       "audit": 3,
       "block": 1,
       "unknown": 0,
       "override": 1
     },
     "policies": [
       {
         "name": "Endpoint DLP - Customer data",
         "count": 2
       },
       {
         "name": "Endpoint DLP - Credentials",
         "count": 1
       },
       {
         "name": "Endpoint DLP - HR data",
         "count": 1
       }
     ],
     "applications": [
       {
         "count": 3,
         "application": "chrome.exe"
       },
       {
         "count": 1,
         "application": "msedge.exe"
       }
     ],
     "sensitiveTypes": [
       {
         "name": "All Full Names",
         "count": 1,
         "matches": 120
       },
       {
         "name": "U.S. Social Security Number (SSN)",
         "count": 1,
         "matches": 42
       },
       {
         "name": "Credit Card Number",
         "count": 3,
         "matches": 19
       },
       {
         "name": "Azure Storage Account Key",
         "count": 1,
         "matches": 1
       }
     ]
   }

2. dlp_audit · Aug 26, 2026
   FileUploadedToCloud 'Q3 customer list.xlsx' to chatgpt.com by [email protected]: Credit Card Number ×14, All Full Names ×120 (audit)
   Detail

   {
     "policies": [
       "Endpoint DLP - Customer data"
     ],
     "recordId": "ual-0099",
     "application": "chrome.exe"
   }

3. dlp_audit · Sep 2, 2026
   TextPastedToBrowser to chatgpt.com by [email protected]: Azure Storage Account Key ×1 (audit)
   Detail

   {
     "policies": [
       "Endpoint DLP - Credentials"
     ],
     "recordId": "ual-0100",
     "application": "chrome.exe"
   }

4. dlp_override · Sep 8, 2026
   FileUploadedToCloud 'payroll-aug.csv' to chatgpt.com by [email protected]: U.S. Social Security Number (SSN) ×42 (override)
   Detail

   {
     "policies": [
       "Endpoint DLP - HR data"
     ],
     "recordId": "ual-0101",
     "application": "msedge.exe"
   }

5. dlp_audit · Sep 9, 2026
   AIAppInteraction to chatgpt.com by [email protected]: Credit Card Number ×3 (audit)
   Detail

   {
     "policies": [],
     "recordId": "ual-0108",
     "application": null
   }

6. dlp_block · Sep 11, 2026
   TextPastedToBrowser to chatgpt.com by [email protected]: Credit Card Number ×2 (block)
   Detail

   {
     "policies": [
       "Endpoint DLP - Customer data"
     ],
     "recordId": "ual-0102",
     "application": "chrome.exe"
   }

7. corroboration
   Also found by another lane (consent:aaaa0002-0000-4000-8000-000000000002)
   Detail

   {
     "findingKey": "consent:aaaa0002-0000-4000-8000-000000000002"
   }

8. corroboration
   Also found by another lane (mdca:11114)
   Detail

   {
     "findingKey": "mdca:11114"
   }

9. corroboration
   Also found by another lane (mde:openai-chatgpt)
   Detail

   {
     "findingKey": "mde:openai-chatgpt"
   }

10. corroboration
    Also found by another lane (mail:openai-chatgpt)
    Detail

    {
      "findingKey": "mail:openai-chatgpt"
    }

11. corroboration
    Also found by another lane (pp:shared_openai)
    Detail

    {
      "findingKey": "pp:shared_openai"
    }