A paid personal artificial intelligence (AI) plan is still a personal plan. A subscription price does not tell you which contracts, administration, or data controls apply. Before sharing work, client, or patient information, confirm the approved account, feature, configuration, and terms.
Two agreements with different jobs
A data processing agreement (DPA) sets terms for a processor's handling of personal data for a customer. A business associate agreement (BAA) addresses HIPAA duties when a vendor acts as a business associate of a covered healthcare organization. Having one does not establish that the other applies.
For personal use, review the provider's consumer terms, privacy policy, and settings. Do not assume that an individual subscription includes your employer's negotiated DPA, BAA, retention controls, or audit capabilities. Equally, avoid the blanket claim that no consumer service can ever have relevant contractual or privacy-law duties: the actual service, role, and agreement matter.
Check the actual feature and data route
Business agreements can cover particular services and exclude others. Review:
- The exact organization and account covered by the agreement.
- The feature or product surface, not just the vendor's name.
- Required administrator settings and eligibility conditions.
- Training, retention, deletion, audit, and incident terms.
- Web search, browsing, external applications, connectors, and previews.
- Each additional company that receives data and the terms applying to that transfer.
For example, Microsoft's documentation distinguishes enterprise data protection from the handling of web-search queries sent to Bing. Anthropic's published BAA guidance also distinguishes eligible services from third-party data flows through connectors. These are reasons to inspect each route, not to generalize one vendor's terms to every provider.
Agreements do not stop prompt injection
An agreement can assign responsibilities. It does not, by itself, stop an email or website from trying to steer an AI. Technical controls still need to limit readable resources, outbound destinations, actions, and retained copies. A read-only connection can expose information it reads even when it cannot directly change the source.
A made-up workplace example
A health plan sends member documents to a reviewer's personal email. The reviewer pastes them into a personal AI account. Neither step should be assumed to fall within the health plan's approved agreements or safeguards.
The organization should use its approved secure route, verify the applicable agreements and configuration, and share only what the task needs. If an unauthorized disclosure may have occurred, report it to the privacy or compliance officer for assessment. Whether an event is reportable depends on the facts and applicable requirements.
Four checks to repeat
- Own IT: Know the task, information owner, account, and all recipients.
- Secure IT: Use the approved environment with narrow access and strong sign-in.
- Protect IT: Share the minimum, review the response, and approve consequential actions.
- Monitor IT: Review access, activity, changes in terms, and cleanup.
Sources
- HHS guidance on personal devices and consumer apps
- Enterprise data protection in Microsoft 365 Copilot
- Anthropic BAA guidance for commercial customers
This is general information, not a legal opinion or a determination that a configuration meets compliance requirements. Confirm the current terms for your organization before using regulated information.
The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.
Apply this in your organization
We help review workplace AI use, policy gaps, data handling, supplier responsibilities, and practical adoption rules. Explore governance services, or discuss your priority by email.