Data privacy for AI tools at university affects every question, every draft and every attachment you give to a chatbot. What happens to these inputs depends on the provider, the type of account and your settings. This guide explains the most important connections and shows what you should watch out for.
Short answer: With private accounts, several large providers may also use your inputs to improve their models under their privacy rules, unless you switch this off. Team, business or university accounts usually offer stronger contractual commitments. Never enter personal data about third parties or unpublished research data. Stand: October 2026, settings change frequently.
The most important points at a glance
- The type of account partly determines how much contractual protection you have.
- Many private accounts allow training on your inputs until you switch this off.
- Personal data about third parties does not belong in a chat, not even as an example.
- Unpublished research data, interviews and health data need particular care.
- Your university sets its own rules. Check them before you use a tool.
What technically happens to your inputs?
Your input is transmitted encrypted to the provider’s servers, where it is processed to generate a response. Usually the provider stores the chat history so that you can find earlier conversations again. There are further processing purposes as well, which are described in the privacy policy. The following overview helps you classify them.
| Processing | Typical purpose | Where to look |
|---|---|---|
| Chat history | You find earlier conversations again | History or chat settings of the app |
| Security and misuse | Protection against attacks and policy violations | Provider’s privacy policy |
| Model training | Improving the models with inputs | Data controls or training settings |
| Manual review | Review of individual conversations in exceptional cases | Provider’s privacy policy |
| Transfers to third countries | Processing on servers outside the EU | Contractual information and privacy policy |
Account type: why it makes a difference
Private accounts are usually subject to the provider’s standard terms. Many of these can be adjusted in the settings. Business, team or enterprise offers conclude contracts with companies. They usually stipulate that inputs are not used for training. Universities sometimes offer their own licences, whose privacy rules are agreed with the university.
A student account is therefore not automatically a university account with a privacy commitment. Which offers exist is covered in the guide AI tools for students 2026: which offers come with student status. In any case, check the current terms of the specific offer before you enter sensitive content.
Also pay attention to where the servers are located and which subprocessors the provider uses. You will find this information in the privacy policy or in the data processing agreement (Auftragsverarbeitungsvertrag). For research data this is especially important, because the university often has to check exactly these points.
What you should not enter
The rule of thumb is this: what you would not post publicly should not go into a chat without checking first. In everyday student life this mainly concerns the following points.
- Names, addresses, phone numbers or student ID numbers of people, including in examples.
- Health data and other special categories under Art. 9 of the General Data Protection Regulation (Datenschutz-Grundverordnung, DSGVO), for example from interview partners or test subjects.
- Unpublished research data, raw data and interview transcripts.
- Access data, passwords, account numbers and identity document details.
- Texts that your university or a company classifies as confidential.
Anonymise examples consistently. Instead of real names, write “Person A”, and instead of real data, use placeholders. This protects third parties, and you can still use the chat. Pay attention to combinations as well: place, age and event can make a person recognisable even without a name.
What does data protection law say?
The GDPR sets the framework. Providers must inform transparently about purposes and retention periods (Art. 13 GDPR). They may only process as much data as the purpose requires (Art. 5(1)(c) GDPR). If data is transferred to countries outside the EU, special safeguards are required (Art. 44 et seq. GDPR).
How far your own obligations go depends on the individual case. Questions about data protection fall under the supervisory authorities, in Germany the Federal Commissioner for Data Protection and the state authorities. Caution remains the best rule in any case.
How to check your settings
The labels differ from provider to provider. Search in the app or in the browser for terms such as privacy, data controls, chat history or model training. Check your settings again after every major update, because menus and default settings change often.
What applies at your university?
Your university’s examination regulations, statutes or internal guidelines determine which AI assistance is permitted and how you must label it. Term papers often have separate requirements on independent work, as described in the guide AI in term papers: what is allowed and what you must disclose. Theses have additional labelling requirements, see AI in theses: labelling requirements.
The data protection rules of your university may also specify which services you are allowed to use for research data. The university’s data protection officer (behördlicher Datenschutzbeauftragter) is the right contact if you have a question about this. Why every university has its own rules is explained in the guide AI rules at universities: why every examination regulation is different.
Data protection and accuracy go together
An AI answer can cite incorrect sources or invent facts. Check statements against primary sources before you use them in a paper. This protects not only your grade but also against errors that come from adopting unchecked content. You will find more on classification in the guide AI Use in Studies: Rules, Disclosure and Tools.
Frequently asked questions
Does a chat disappear when I delete it?
In the interface it is gone, but not necessarily immediately from all of the provider’s systems. When data is finally deleted is stated in the privacy policy. Ask there about the deletion periods before you enter anything sensitive.
May I upload university documents?
Only if your university has approved the tool or the content is not confidential. Unpublished reports, exam questions and research data generally do not belong there. If in doubt, ask your university.
Is removing names enough?
Not always. Anonymisation requires more than deleting a name. Combinations of place, age, occupation and event can still make people recognisable. Therefore check the entire text, not just the spots where names appear.
Is a free account less secure than a paid one?
Often yes, because contract terms and setting options differ. But a paid account is not automatically more secure. What matters are the conditions for training, storage and access. Read them for the specific plan, not for the brand as a whole.
Related reading
- AI tools for students 2026: which offers come with student status
- AI rules at universities: why every examination regulation is different
- AI in term papers: what is allowed and what you must disclose
- AI Use in Studies: Rules, Disclosure and Tools
- Learning with AI: Opportunities and Risks for Students
How to proceed now
- Check which account you use and read the privacy policy for exactly that plan.
- Set model training and chat history the way you want them, and check this again after updates.
- Ask your university whether an offer with a privacy commitment is available.
- Anonymise all examples before you paste them in.
- Check AI answers against primary sources before you adopt them.
Sources: Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), full text on EUR-Lex (Stand: retrieved October 2026), Federal Commissioner for Data Protection and Freedom of Information (BfDI) (Stand: October 2026).
Stand: October 2026. This guide is general information, not individual advice.
