Abstract

The increasing use of artificial intelligence in professional practice has introduced a new dimension to the traditional principles of privacy, confidentiality, data protection and professional responsibility. ChatGPT, developed by OpenAI, is now widely used for legal research, document drafting, contract review, correspondence, case analysis and other professional activities. Its convenience and analytical capabilities, however, raise an important question: when a lawyer, business professional or individual uploads a confidential document or communicates sensitive information through ChatGPT, who can access that information, how is it processed, and can it be used to train artificial intelligence models?

The assumption that information submitted to a private ChatGPT account is accessible exclusively to the account holder is not entirely correct. Although private conversations are not ordinarily published or made accessible to other users, OpenAI processes the information submitted to its services and may permit access by authorised personnel and service providers in specified circumstances. Furthermore, the use of submitted content for model improvement depends on the nature of the account, applicable contractual arrangements and the user’s privacy settings.

This article examines the privacy framework governing ChatGPT, the distinction between private communications and confidential information, the implications for legal professional privilege, the obligations imposed by the Nigeria Data Protection Act 2023, cross-border data processing, and the professional responsibilities of lawyers and other users of AI systems. It also considers practical safeguards that law firms and organisations should adopt to ensure that the benefits of artificial intelligence do not come at the expense of confidentiality, privacy and professional integrity.

Keywords: Artificial Intelligence, ChatGPT, OpenAI, Data Privacy, Nigeria Data Protection Act 2023, Legal Professional Privilege, Client Confidentiality, AI Training, Cross-Border Data Transfer, Cybersecurity.

1. Introduction

Artificial intelligence is changing the way professional services are delivered. In the legal profession, AI-powered systems such as ChatGPT have become useful tools for drafting legal documents, analysing contractual provisions, summarising judgments, conducting preliminary legal research, preparing correspondence, developing legal arguments and assisting with the management of professional workloads.

The technology offers significant advantages. It can reduce the time required to undertake routine tasks, improve productivity, assist with the organisation of complex information and provide analytical support to legal practitioners.

However, the growing reliance on these systems raises a fundamental legal and ethical question: What happens to the information we submit to artificial intelligence platforms?

Consider a lawyer who uploads a client’s statement of claim, a confidential settlement proposal, a draft legal opinion, a deed of assignment or an entire case file to ChatGPT for review. The lawyer may reasonably assume that because the conversation takes place within a private account, the information remains exclusively within the lawyer’s control.

That assumption requires qualification.

There is an important distinction between information that is not publicly accessible and information that is accessible only to the person who submitted it. A private ChatGPT conversation is not ordinarily visible to other users. Nevertheless, OpenAI’s systems must process the submitted information, and the company’s privacy arrangements permit certain forms of access, retention, processing and, depending on the applicable settings, use for model improvement.

Consequently, the fact that a conversation is private from the general public does not necessarily mean that it is confidential in the strict legal, professional or technical sense.

For lawyers, this distinction is particularly important. The duty to protect client information does not disappear merely because a new technology provides a convenient means of processing that information. The introduction of AI into legal practice must therefore be examined against existing obligations concerning client confidentiality, legal professional privilege, data protection, cybersecurity and professional competence.

The central issue is not whether lawyers should use artificial intelligence. It is whether they can use it responsibly without compromising the rights and interests of their clients.

2. Understanding the Privacy Architecture of ChatGPT

To properly assess the privacy implications of ChatGPT, it is necessary to understand the distinction between privacy, confidentiality, security and data control.

These concepts are related but are not interchangeable.

2.1 Privacy

Privacy concerns the extent to which an individual can control information relating to them and the circumstances in which such information is collected, processed, disclosed or used. Principles include [1] Section 37 – Right to Privacy.

A user’s ChatGPT conversations are not ordinarily made publicly available. Other users cannot simply search the platform and retrieve another person’s private conversations or uploaded documents.

However, the platform operator necessarily processes information submitted through the service. This may include prompts, responses, uploaded documents, images, audio and other content, together with associated technical information. This processing is subject to [2] Governing framework for personal data processing in Nigeria.

2.2 Confidentiality

Confidentiality concerns the obligation to protect information against unauthorised disclosure or use. Principles include [3] Section 192 – Protection of professional communications and [4] Rule 19 – Privilege and confidence of clients.

In professional practice, confidentiality may arise from contractual obligations, fiduciary relationships, professional rules, statutory provisions or the common law.

A document may be private in the sense that it is not accessible to the general public, yet still be subject to processing by a third-party service provider.

Accordingly, the absence of public access does not, by itself, establish that a platform satisfies every confidentiality obligation owed by a lawyer to a client.

2.3 Security

Security concerns the technical and organisational measures adopted to protect information against unauthorised access, alteration, destruction, loss or disclosure.

These measures may include encryption, access controls, authentication, monitoring, logging, incident response and internal security policies.

Security does not mean that information is inaccessible to everyone except its owner. An authorised service provider may need to process information to deliver the service, maintain security or comply with legal obligations.

2.4 Data control

Data control concerns the rights and mechanisms available to users to determine how their information is processed, retained, shared, used or deleted.

ChatGPT provides several privacy and data-control features, including data controls, Temporary Chat, account-level settings and privacy requests.

The availability of these features does not eliminate the need to understand the applicable terms of service and privacy policy.

The distinction is therefore straightforward: a private account is not the same thing as a completely isolated data environment.

3. Who Can Access Information Submitted to ChatGPT?

One of the most frequently misunderstood aspects of ChatGPT is the question of who can access a user’s conversations and uploaded documents.

The fact that a conversation is private from other users does not mean that the platform operator has no access to it.

3.1 Access by other ChatGPT users

Ordinary users cannot browse another user’s private conversations, uploaded documents or chat history.

ChatGPT does not operate as a public document repository in which every uploaded file becomes available to other subscribers. A user must generally have access to the relevant account or an authorised sharing mechanism to see its contents.

There are, however, exceptions arising from user actions. For example, a user who creates and distributes a shared conversation link may make the shared content accessible to recipients of that link.

Account compromise, unauthorised access to a user’s device and insecure account-sharing practices also present separate risks.

3.2 Access by OpenAI personnel

OpenAI’s published privacy documentation expressly recognises that a limited number of authorised personnel and trusted service providers may access user content in specified circumstances.

These include:

• Investigating suspected abuse or security incidents.
• Providing customer support where assistance is requested.
• Troubleshooting problems affecting the service.
• Handling legal matters.
• Improving model performance where the applicable user settings permit it.

OpenAI states that such access is restricted through technical controls, need-to-know permissions, monitoring and access logging. Personnel with access are also subject to security and privacy training and confidentiality obligations.

This is an important qualification to the concept of privacy.

A user should not assume that uploading a confidential legal document to ChatGPT makes it technically inaccessible to OpenAI employees. Equally, the existence of authorised access does not mean that OpenAI employees are routinely reading individual users’ conversations.

The company’s stated position is that access is limited to specified operational and legal purposes.

3.3 Access by third-party service providers

OpenAI also uses trusted service providers to support the operation of its services.

These providers may process information for purposes such as hosting, infrastructure, security, support and other operational functions.

OpenAI states that content may be stored on its systems and those of trusted service providers in the United States and other countries. Selected portions may also be provided to service providers for data annotation and safety purposes, subject to confidentiality and security obligations.

This introduces another dimension of data protection: the information may be processed outside the country in which the user resides.

3.4 Access by government authorities

Like other technology companies, OpenAI may be required to disclose information in response to valid legal processes or other legally binding obligations.

The existence of a privacy policy does not exempt a technology company from applicable laws governing lawful access, disclosure, investigations and court orders.

Accordingly, users should not interpret the confidentiality of a private account as a guarantee that information can never be obtained by a competent authority.

3.5 Access by advertisers and the general public

OpenAI states that it does not sell users’ personal data or share their ChatGPT conversations with advertisers.

It is therefore necessary to distinguish advertising displayed on a platform from disclosure of the underlying private conversations to advertisers.

The presence of advertising does not, by itself, establish that advertisers have access to the user’s conversations.

4. Can OpenAI Use Uploaded Documents and Conversations to Train Artificial Intelligence?

This is one of the most significant privacy issues for professionals using AI platforms.

Artificial intelligence models are developed and improved through the processing of information. However, not every interaction with an AI platform is necessarily used for model training.

OpenAI makes a distinction between individual consumer accounts and business or managed-workspace accounts.

4.1 Consumer accounts

For individual ChatGPT accounts, including Free, Go, Plus and Pro, content may be used to improve OpenAI’s models depending on the applicable settings.

This is important because the submission of a document to ChatGPT may involve more than simply obtaining an answer.

Depending on the user’s settings, submitted content may include:

• Questions and instructions.
• The model’s responses.
• Uploaded PDF documents.
• Word documents and spreadsheets.
• Images and other submitted files.
• Other content provided during the interaction.

OpenAI provides a setting called Improve the model for everyone, which allows individual users to opt out of the use of their content for model improvement.

The important point is that the default position for consumer accounts should not be confused with the default position for business accounts.

4.2 What happens when a user opts out?

When a user disables model improvement, OpenAI states that new conversations will not be used to train its models, subject to the applicable exceptions and policies.

The setting does not automatically delete the user’s conversations or uploaded documents.

It is therefore possible for information to remain stored in the user’s account while being excluded from the model-improvement process.

There is also an important exception concerning feedback. OpenAI states that if a user submits a thumbs-up or thumbs-down rating on a response, the conversation associated with that feedback may be used to improve models even where the user has opted out.

This is a particularly important detail for users handling sensitive information.

4.3 Business and Enterprise accounts

OpenAI offers different data-processing arrangements for organisational customers.

According to its published business privacy commitments, information submitted through ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu and its API platform is not used to train or improve models by default.

This includes both inputs and outputs.

The distinction is significant.

Business and Enterprise offerings also provide additional security and governance capabilities. OpenAI describes encryption in transit and at rest, administrative controls and configurable retention arrangements for qualifying customers.

However, it would be incorrect to conclude that business accounts are completely inaccessible to OpenAI or that they provide absolute confidentiality.

The no-training commitment is not the same as a prohibition on all processing or authorised access.

4.4 Does model training mean that somebody will see your document in another user’s response?

Not necessarily.

There is an important technical distinction between using information to improve a model and storing a document in a public database that can be retrieved by another user.

Model training involves computational processes through which a model’s parameters may be adjusted to improve its performance. It does not ordinarily mean that the model simply stores an uploaded contract as a retrievable file.

Nevertheless, it would be unsafe to assume that training creates no privacy risk. There are recognised concerns involving memorisation, extraction and the reproduction of personal or confidential information.

OpenAI states that it trains its models to avoid responding to requests for private or sensitive information about individuals.

That safeguard should not be interpreted as an absolute guarantee that sensitive information can never be reproduced or exposed.

The prudent approach is to prevent unnecessary confidential information from entering a training-eligible environment in the first place.

5. Temporary Chat: Does It Provide Complete Confidentiality?

ChatGPT provides a feature known as Temporary Chat.

This feature is useful where a user wishes to have a conversation without retaining it in the normal chat history.

According to OpenAI, Temporary Chats:

1. Do not appear in the ordinary chat history.
2. Are not used to improve OpenAI models while they remain temporary.
3. Do not create or update memories.
4. May nevertheless be retained for up to 30 days for safety purposes.
5. May be subject to applicable account and workspace restrictions.

If a Temporary Chat is saved as a regular conversation, the ordinary retention and model-improvement settings subsequently apply.

It is therefore useful to distinguish between three separate issues:

• Whether the conversation appears in the user’s history.
• Whether the information is used for model improvement.
• Whether the information is retained on the service provider’s systems.

Temporary Chat addresses the first two while introducing a limited retention arrangement for safety purposes.

It should not be regarded as a complete solution for handling highly sensitive client information.

6. Retention and Deletion of Documents and Conversations

Another important issue is whether information uploaded to ChatGPT remains on OpenAI’s systems indefinitely.

The answer depends on the nature of the account, the type of information and the applicable retention arrangements.

6.1 Ordinary conversations

Regular conversations generally remain in the user’s account until they are deleted or removed under an applicable workspace retention policy.

Archiving a conversation does not amount to deletion. It merely removes the conversation from the ordinary chat listing.

6.2 Deletion of conversations

OpenAI states that when a user deletes a saved conversation, it is immediately removed from the user’s account view and scheduled for permanent deletion from its systems within 30 days.

There are exceptions, including where information has already been de-identified and disassociated from the account, or where longer retention is required or permitted for legal or security reasons.

This means that pressing the delete button should not be understood as proof that every copy of the information has been instantaneously erased from every system.

6.3 Uploaded files

Documents uploaded to ChatGPT may be subject to retention rules that differ according to where and how they were uploaded.

For example, files associated with a conversation may have separate storage arrangements through ChatGPT’s file-management features.

Consequently, deleting a conversation should not automatically be assumed to have deleted every independently retained copy of an uploaded document.

A user handling sensitive material should understand both conversation retention and file retention.

6.4 Legal and regulatory retention

A service provider may retain certain information beyond an ordinary deletion period where required by law, for security, fraud prevention or other permitted purposes.

This is not unique to OpenAI. It is a feature of many regulated digital services.

The practical implication is that users should not upload information on the assumption that they can always guarantee its immediate and irreversible removal.

7. The Legal Position Under Nigerian Law

The privacy implications of ChatGPT are particularly relevant to Nigerian users because Nigeria has a statutory framework governing personal data processing and constitutional protection of privacy.

The principal legal instruments include:

1. The Constitution of the Federal Republic of Nigeria 1999, as amended.
2. The Nigeria Data Protection Act 2023.
3. The Nigeria Data Protection Commission’s applicable regulations and guidance.
4. The Evidence Act 2011, as amended.
5. The Rules of Professional Conduct for Legal Practitioners 2023.
6. Other applicable laws governing cybersecurity, electronic transactions and confidentiality.

The question is whether the processing of personal and confidential information through an AI platform can be reconciled with these legal obligations.

7.1 Section 37 of the Constitution: Right to privacy

Section 37 of the Constitution of the Federal Republic of Nigeria 1999, as amended, guarantees and protects the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications [1].

The constitutional protection recognises privacy as a fundamental right.

The increasing use of digital platforms raises important questions about the application of this right to electronically stored information, digital correspondence, cloud services and AI-powered communication systems.

Where individuals provide personal information to a digital service, the collection and processing of that information must be considered within the applicable legal framework.

However, it is important to distinguish between the constitutional right to privacy and the contractual or statutory obligations of a service provider. Not every instance of third-party processing automatically constitutes a constitutional violation. The legality of the processing must be assessed in its proper circumstances.

7.2 The Nigeria Data Protection Act 2023

The Nigeria Data Protection Act 2023 is the principal legislation governing the processing of personal data in Nigeria [2].

The Act was signed into law on 12 June 2023 and established the Nigeria Data Protection Commission (NDPC) as the regulatory authority responsible for overseeing personal data protection in the country.

The Act is particularly relevant to ChatGPT because uploading a document containing personal information to an AI platform may constitute processing of personal data.

The statutory definition of processing is broad. It encompasses activities such as collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, erasure and destruction of personal data.

Consequently, the use of AI to analyse, summarise or transform a document containing personal data is not outside the scope of data protection merely because the processing is automated.

7.3 Territorial application

The Act has a potentially wide territorial reach.

According to the NDPC, the Act applies where:

• An organisation is domiciled, resident or operating in Nigeria.
• Personal data is processed within Nigeria.
• An organisation outside Nigeria processes personal data relating to a data subject in Nigeria, subject to the statutory conditions.

This is important because an organisation does not necessarily escape Nigerian data protection obligations merely because it uses a foreign cloud service or an AI platform operated outside Nigeria.

Nigeria Data Protection Commission

The fact that ChatGPT is operated by a foreign technology company does not, by itself, remove the Nigerian data protection implications of a Nigerian lawyer’s or organisation’s processing activities.

7.4 The principles of lawful data processing

Section 24 of the Nigeria Data Protection Act establishes fundamental principles governing personal data processing.

These include requirements that personal data be processed:

• Lawfully, fairly and transparently.
• For specified, explicit and legitimate purposes.
• In a manner that is adequate, relevant and limited to what is necessary.
• Accurately and, where necessary, kept up to date.
• For no longer than necessary for the purpose of processing.
• With appropriate security safeguards.

The Act also requires accountability in the processing of personal data.

These principles are directly relevant to organisations that use AI platforms to process information belonging to clients, employees, customers and other individuals.

For example, a law firm that uploads a client’s entire litigation file to an AI platform merely to obtain a summary of one document may need to consider whether the disclosure is necessary and proportionate to the intended purpose.

If the relevant task can be completed using an anonymised extract, uploading the entire file may be difficult to justify under the principle of data minimisation.

7.5 Lawful basis for processing

Section 25 of the Nigeria Data Protection Act identifies the lawful bases upon which personal data may be processed.

These include:

1. Consent of the data subject.
2. Necessity for the performance of a contract to which the data subject is a party or for steps taken at the request of the data subject before entering into a contract.
3. Compliance with a legal obligation.
4. Protection of vital interests.
5. Performance of a task carried out in the public interest or in the exercise of official public authority.
6. Legitimate interests pursued by the data controller or another person, subject to the applicable balancing requirements.

The use of ChatGPT to process client information therefore requires an assessment of the lawful basis applicable to the particular processing activity.

It would be incorrect to assume that consent is the only possible lawful basis. Equally, it would be incorrect to assume that the mere fact that a client has engaged a lawyer automatically authorises every form of third-party AI processing.

The purpose, nature and extent of the processing must be examined.

7.6 Data protection impact assessments

Where a proposed processing activity is likely to result in a high risk to the rights and freedoms of data subjects, the Act provides for a data protection impact assessment.

This is particularly relevant to organisations deploying AI systems on a large scale or processing sensitive personal information.

For instance, a law firm developing an AI-assisted case-management system that processes thousands of client files should consider whether a formal assessment is required.

The assessment should examine:

• The purpose of the processing.
• The categories of personal data involved.
• The necessity and proportionality of the processing.
• The risks to the rights of data subjects.
• The safeguards adopted to mitigate those risks.
• The roles and responsibilities of the parties involved.

A DPIA should not be treated as a mere administrative formality. It is a risk-management instrument that helps organisations identify privacy problems before they result in harm.

7.7 Data security obligations

Legal practitioners must also ensure that communications with AI platforms do not breach professional confidentiality obligations, such as those set out in Section 192 of the Evidence Act [3] and Rule 19 of the Rules of Professional Conduct [4].

The Act requires appropriate technical and organisational measures to protect personal data.

This obligation is relevant to both the organisation submitting information and the service provider processing it.

A law firm should therefore consider the security arrangements of any AI platform before authorising its use for client information.

Relevant considerations include encryption, account authentication, access restrictions, auditability, data retention, incident management and the ability to control the use of submitted information.

It is not sufficient for an organisation to rely entirely on the technology provider’s assurances. The organisation must also implement safeguards within its own systems and operations.

7.8 Cross-border transfer of personal data

Perhaps one of the most important legal issues concerns international data transfers.

OpenAI states that information submitted through its consumer services may be stored on its systems and those of trusted service providers in the United States and other countries.

This raises questions under Part VIII of the Nigeria Data Protection Act, particularly sections 41-43, which regulate transfers of personal data to foreign countries or international organisations.

The statutory framework recognises mechanisms for ensuring adequate protection in the receiving jurisdiction. These include adequacy decisions and appropriate cross-border data transfer instruments, as well as certain statutory grounds and exceptions.

The NDPC identifies these mechanisms in its guidance on international data transfers.

Nigeria Data Protection Commission

Accordingly, a Nigerian organisation using an overseas AI service to process personal data must examine the applicable cross-border transfer requirements.

It should not assume that the existence of a privacy policy or the international reputation of a technology company automatically satisfies every requirement of Nigerian law.

There must be an appropriate assessment of the parties’ respective roles, the applicable transfer mechanism, the nature of the data and the safeguards available.

An important qualification: The fact that OpenAI operates systems in multiple countries does not, without further examination of the relevant processing arrangements, establish the precise destination of every Nigerian user’s information or conclusively determine the legal transfer mechanism applicable to each transaction.

The compliance question must therefore be addressed by reference to the actual service, contractual documentation and data-processing arrangement.

8. Legal Professional Confidentiality and Privilege: A Particular Concern for Lawyers

The use of ChatGPT by lawyers presents a more complex issue than ordinary personal data processing.

A lawyer’s obligation to protect client information is not limited to personal data. It extends to confidential information obtained during the professional relationship, including commercial information, legal advice, litigation strategies, settlement positions and other information that may not necessarily fall within the definition of personal data.

This distinction is fundamental.

A commercial agreement between two companies may contain no personal information whatsoever. Nevertheless, its contents may be confidential and protected by contractual obligations.

Similarly, a litigation strategy may contain information that is not personal data but is highly sensitive and protected by professional confidentiality and privilege.

Therefore, compliance with data protection legislation alone does not exhaust a lawyer’s confidentiality obligations.

8.1 Rule 19 of the Rules of Professional Conduct for Legal Practitioners 2023

The Rules of Professional Conduct for Legal Practitioners 2023, which commenced on 1 January 2024, contain specific provisions governing the relationship between lawyers and their clients.

Rule 19 addresses the privilege and confidence of clients.

The rule reinforces the professional obligation of a lawyer to preserve confidential information obtained in the course of professional engagement, subject to recognised exceptions.

These obligations are not merely matters of courtesy or good professional practice. They form part of the standards governing the conduct of legal practitioners in Nigeria.

The implications for AI use are considerable.

A lawyer who uploads confidential client documents to a third-party AI service must consider whether the disclosure is consistent with the duty owed to the client.

The relevant question is not simply whether the AI platform is secure. It is whether the lawyer has taken reasonable steps to ensure that the information is processed in a manner consistent with the client’s rights and the lawyer’s professional obligations.

8.2 Section 192 of the Evidence Act

Section 192 of the Evidence Act 2011, as amended, protects professional communications between a client and a legal practitioner.

It provides, in substance, that a legal practitioner must not disclose, without the client’s express consent:

• Communications made by or on behalf of the client in the course and for the purpose of professional employment.
• The contents or condition of documents encountered in the course of professional employment.
• Advice given to the client in the course of such employment.

The protection is subject to statutory exceptions, including communications made in furtherance of an illegal purpose and facts observed by the lawyer indicating that a crime or fraud has been committed since the commencement of the professional engagement.

The obligation continues even after the professional employment has ended.

Section 193 extends the relevant protection to interpreters and clerks of legal practitioners.

These provisions demonstrate the importance Nigerian law attaches to confidentiality in the lawyer-client relationship.

8.3 Does uploading a privileged document to ChatGPT automatically waive legal professional privilege?

This is a difficult question and one that should not be answered categorically.

There is an important distinction between:

1. A lawyer using an AI system as a tool to analyse a document without making its contents publicly available.
2. A lawyer disclosing privileged material to an independent third party without appropriate safeguards.
3. A lawyer using a service under contractual and technical arrangements designed to preserve confidentiality.
4. A lawyer intentionally publishing privileged material or providing access to persons who are not authorised to receive it.

Uploading a privileged document to ChatGPT does not, by itself, necessarily establish that the lawyer has waived privilege under Nigerian law.

Equally, there is no basis for assuming that every disclosure to an AI service provider is legally irrelevant merely because the information is not publicly available.

The question would depend on the circumstances of the disclosure, the nature of the service provider’s role, the contractual terms, the level of confidentiality reasonably maintained, the purpose of the processing and the applicable legal principles.

It is also necessary to distinguish the evidential protection afforded to professional communications from the broader professional duty of confidentiality.

A document may remain privileged against compulsory disclosure in legal proceedings while the lawyer may nevertheless have breached a professional or contractual duty by handling it improperly.

The safest position is therefore to avoid uploading identifiable privileged material to a consumer AI account unless there is a properly assessed basis for doing so and adequate safeguards are in place.

8.4 Does client consent solve the problem?

Client consent is relevant, but it should not be treated as an automatic answer to every confidentiality and data protection concern.

For consent to be meaningful, the client should understand:

• What information will be uploaded.
• The identity and nature of the AI service provider.
• The purpose for which the information will be processed.
• Whether the information may be retained.
• Whether the information may be used for model improvement.
• Whether the information may be processed outside Nigeria.
• The principal risks associated with the proposed processing.

Where personal data is involved, the requirements for valid consent under the Nigeria Data Protection Act must also be considered.

Furthermore, consent does not necessarily remove every other professional obligation or legal restriction.

For example, a lawyer may still need to consider confidentiality owed to third parties, court-imposed restrictions, contractual non-disclosure obligations and the security of the proposed processing environment.

8.5 Confidentiality obligations continue after the retainer

An important aspect of professional confidentiality is that it does not ordinarily terminate when the lawyer-client relationship ends.

Section 192 of the Evidence Act expressly recognises the continuation of the relevant professional communication obligation after the termination of employment.

Rule 19 of the Rules of Professional Conduct must also be considered in this context.

Consequently, a lawyer cannot assume that a former client’s documents become available for unrestricted use in AI systems simply because the matter has been concluded or the retainer has expired.

The same caution applies to law firms disposing of archived files, transferring documents to cloud services or using historical client files to develop internal AI knowledge bases.

9. Is OpenAI a Data Controller or a Data Processor?

An important question in applying data protection law is identifying the respective roles of the parties involved.

Under data protection frameworks, a data controller is generally the person or organisation that determines the purposes and means of processing personal data. A data processor processes personal data on behalf of a controller.

In an ordinary legal practice scenario, the law firm may be a controller in respect of client information because it determines why and how that information is processed.

The technology provider may perform processing functions on behalf of the organisation under the applicable service arrangements.

However, the classification should not be assumed without examining the relevant contractual and operational arrangements.

A service provider may have independent responsibilities and may process certain information for its own purposes, including security, service integrity and compliance with legal obligations.

The roles may therefore differ depending on the particular processing activity.

9.1 Why the distinction matters

The distinction is important because the parties’ legal obligations are not necessarily identical.

A law firm acting as a controller must consider:

• The lawful basis for processing.
• Transparency and notice obligations.
• Data minimisation.
• Data subject rights.
• Retention and deletion.
• Appropriate security safeguards.
• Accountability and record-keeping.
• Cross-border transfer requirements.

A processor acting on behalf of the firm must comply with the applicable statutory and contractual requirements governing processor relationships.

The parties should therefore establish their respective responsibilities before using an AI platform for substantial or sensitive client-data processing.

9.2 Data Processing Agreements

For organisational use, a data processing agreement is an important instrument.

It should address:

1. The subject matter and duration of processing.
2. The nature and purpose of processing.
3. The categories of personal data involved.
4. The categories of data subjects.
5. The security measures to be implemented.
6. Confidentiality obligations.
7. The use of subprocessors.
8. Assistance with data subject requests.
9. Data breach notification and cooperation.
10. Data deletion or return at the end of the engagement.
11. International data transfers.
12. Audit and compliance rights.

The organisation should also determine whether the service provider’s standard contractual documentation adequately addresses its regulatory and professional obligations.

10. The Risks of Using AI for Legal Practice

The privacy question is only one part of the broader risk associated with AI-assisted legal practice.

There are several other considerations.

10.1 Accidental disclosure

A lawyer may inadvertently upload an entire client file when only a particular document is required.

For example, a lawyer seeking assistance with a tenancy agreement may upload a folder containing the agreement, the client’s identification, bank details, correspondence and other unrelated documents.

This creates unnecessary exposure.

The principle of data minimisation suggests that only information genuinely required for the task should be processed.

10.2 Inaccurate AI outputs

AI systems can produce inaccurate legal citations, misstate statutory provisions, misunderstand contractual language or generate fictitious authorities.

The convenience of an AI-generated legal opinion does not make it authoritative.

A lawyer must independently verify legal authorities, statutory provisions, procedural requirements and factual assumptions before relying on AI-generated work.

10.3 Disclosure of litigation strategy

Litigation strategy is particularly sensitive.

An uploaded case analysis may contain:

• The weaknesses of a client’s case.
• Proposed settlement positions.
• Anticipated cross-examination questions.
• Admissions and evidential difficulties.
• Internal assessments of opposing counsel.
• Proposed litigation tactics.

Even where such information is not personal data, its disclosure may create serious professional and commercial risks.

10.4 Third-party integrations

Some AI services connect to external applications, websites, plugins or other third-party systems.

Information submitted through such integrations may be processed under the privacy policies and contractual arrangements of those external providers.

Temporary Chat does not necessarily prevent a third-party action from receiving and retaining information that is transmitted to it. OpenAI expressly warns that third-party actions may be governed by the recipient’s own privacy arrangements.

A law firm should therefore assess not only the AI platform but also any external service connected to it.

10.5 Account and device compromise

Even where the service provider has robust security arrangements, a user’s account may be compromised through phishing, weak passwords, malware, insecure devices or unauthorised account sharing.

The security of the AI environment is therefore dependent partly on the security practices of the organisation using it.

10.6 Overreliance on AI-generated legal work

There is also a professional responsibility risk in treating AI-generated content as a substitute for legal judgment.

AI may assist a lawyer, but it does not assume the lawyer’s professional responsibility to the client.

A lawyer remains responsible for the accuracy, legality and suitability of advice and documents delivered under the lawyer’s name.

11. Practical Privacy Safeguards for Lawyers and Law Firms

The solution is not necessarily to prohibit the use of AI. Such a prohibition may deprive a law firm of useful technology and place it at a disadvantage in an increasingly digital professional environment.

The more appropriate approach is to establish a clear framework governing the use of AI.

The following safeguards are recommended.

11.1 Adopt an AI usage policy

Every law firm should have a written policy governing the use of AI platforms by partners, associates, trainees, administrative staff and other personnel.

The policy should identify:

• Approved AI platforms.
• Permitted and prohibited uses.
• Categories of information that may be uploaded.
• Anonymisation requirements.
• Client consent procedures.
• Security requirements.
• Verification of AI-generated legal work.
• Responsibility for monitoring compliance.

11.2 Classify information according to sensitivity

A law firm should classify its information into different categories.

The classification should guide the level of protection required.

11.3 Anonymise client information

Where possible, lawyers should remove:

• Names of clients.
• Residential addresses.
• Telephone numbers.
• Email addresses.
• Bank account details.
• Passport numbers.
• National identification numbers.
• Signatures.
• Other identifying particulars.

For example, instead of uploading a document identifying a client as Mr John Smith of 12 Marina Road, Lagos, the lawyer may substitute the name with “Client A” and remove the address.

However, anonymisation must be genuine.

Simply replacing a person’s name may not be sufficient where other information in the document can readily identify that person.

Pseudonymised information may still constitute personal data under applicable data protection law.

11.4 Disable model improvement on consumer accounts

Where individual ChatGPT accounts are used, users should review the Data Controls settings and disable Improve the model for everyone where they do not wish their conversations to be used for model improvement.

This should be treated as a baseline precaution, not a substitute for proper data governance.

11.5 Use business-grade AI environments

For law firms that regularly process confidential information, a managed business environment may provide more appropriate safeguards.

ChatGPT Business and Enterprise have a no-training-by-default commitment, together with additional organisational controls.

However, the choice between the available plans should be based on the firm’s actual requirements, including access management, retention, contractual protections, security, administrative oversight and regulatory compliance.

11.6 Restrict access

A firm should ensure that only authorised personnel have access to approved AI accounts and systems.

Shared passwords and informal account-sharing arrangements should be discouraged.

Where available, multi-factor authentication, single sign-on and role-based access controls should be implemented.

11.7 Establish a verification protocol

Every AI-generated legal document should be reviewed by a qualified lawyer before being sent to a client, filed in court or relied upon in a transaction.

The review should include verification of:

• Statutory provisions.
• Judicial authorities.
• Legal propositions.
• Contractual references.
• Factual assertions.
• Dates and procedural requirements.
• Calculations and financial figures.

11.8 Maintain an incident response procedure

A firm should establish a procedure for responding to accidental disclosure or other AI-related data incidents.

This should include:

1. Immediate identification of the affected information.
2. Restriction of further access where possible.
3. Notification of the firm’s designated privacy or security officer.
4. Assessment of the nature and extent of the incident.
5. Determination of applicable notification obligations.
6. Communication with affected clients where required.
7. Remedial action and documentation.

Where a personal data breach occurs, the notification obligations and applicable time limits under the Nigeria Data Protection Act must be considered.

12. ChatGPT Business and Enterprise: Are They Appropriate for Law Firms?

For a law firm that intends to integrate AI into its regular operations, the distinction between individual and business accounts deserves serious consideration.

OpenAI’s business offerings are designed to provide additional organisational controls and different data-processing commitments.

The most significant difference is that business workspace information is not used for model training by default.

Other features include encryption, administrative access controls and additional retention arrangements, depending on the product and subscription.

12.1 ChatGPT Business

This may be suitable for small and medium-sized law firms seeking a managed AI environment for associates and other personnel.

Its principal advantages include:

• No model training on business data by default.
• Organisational workspace management.
• Centralised user administration.
• Enhanced security arrangements.
• Business-oriented collaboration features.

However, a firm should still examine the contractual arrangements, retention settings and available administrative controls.

12.2 ChatGPT Enterprise

Enterprise is intended for organisations requiring more extensive governance, security and administrative capabilities.

Depending on the applicable arrangements, these may include:

• Advanced identity and access management.
• More extensive administrative controls.
• Custom retention policies.
• Enterprise security and compliance capabilities.
• Additional data residency options for eligible customers.

OpenAI’s enterprise privacy documentation describes the additional controls and commitments available to qualifying organisations.

12.3 Is a business subscription sufficient to satisfy Nigerian law?

Not automatically.

A business subscription may reduce certain risks, particularly the risk of submitted information being used for model training.

However, it does not automatically establish compliance with the Nigeria Data Protection Act or the professional obligations governing legal practice.

The firm must still consider the lawful basis for processing, transparency, cross-border transfers, client confidentiality, security, retention and its own accountability obligations.

The appropriate approach is to treat the business subscription as one component of a wider data governance framework, not as a substitute for that framework.

13. Implications for Other Professional Sectors

Although the legal profession provides a particularly clear example of the risks, the same principles apply to other sectors.

13.1 Medical practitioners

Doctors and hospitals may use AI to summarise medical records, assist with administrative work and analyse clinical information.

Medical records contain sensitive personal data and require appropriate confidentiality and security safeguards.

13.2 Accountants and auditors

Accountants may upload financial statements, tax returns, payroll records and bank statements.

These documents may contain commercially sensitive information and personal financial data.

13.3 Financial institutions

Banks and other financial institutions must consider confidentiality, regulatory obligations, information security and the risks of exposing customer records to external AI services.

13.4 Employers

Employers using AI to process employee records, performance reviews, payroll data or recruitment information must consider the privacy rights of employees and applicants.

13.5 Government institutions

Public institutions processing citizens’ personal information must consider statutory confidentiality obligations, data protection, national security and public-sector information governance.

The common principle is that the use of AI does not remove existing legal obligations governing information.

14. The Wider Policy Question: Who Should Bear Responsibility for AI-Related Data Risks?

The development of artificial intelligence has created a situation in which the traditional boundaries between information ownership, data processing and information control are increasingly complex.

A person may own a document, retain copyright in its contents and remain entitled to confidentiality, while a technology provider processes the information to deliver an AI service.

These different legal interests should not be confused.

The fact that a service provider processes a document does not necessarily mean that ownership of the document transfers to that provider.

Similarly, ownership of the document does not necessarily give the owner complete control over every copy or processing activity undertaken by the service provider.

There is therefore a need for greater clarity in the contractual and regulatory framework governing AI services.

14.1 Transparency

AI providers should make their data-processing practices sufficiently clear to enable users to understand what happens to submitted information.

Users should not have to navigate complicated contractual documents merely to discover whether their confidential information may be used for model improvement.

14.2 Meaningful user control

Users should have effective mechanisms to manage model training, retention, deletion, sharing and third-party integrations.

14.3 Professional-sector standards

Professional regulatory bodies should provide practical guidance on the responsible use of AI.

For the legal profession, such guidance should address client consent, confidentiality, privilege, cloud processing, cross-border transfers and professional accountability.

14.4 Regulatory cooperation

Data protection authorities should engage with AI service providers and professional organisations to develop practical compliance standards.

This is particularly important for countries such as Nigeria, where organisations increasingly rely on foreign technology platforms to process information belonging to local individuals and businesses.

15. Conclusion

Artificial intelligence presents an important opportunity for improving professional productivity, expanding access to information and transforming the delivery of professional services.

However, the benefits of AI must be balanced against the rights of individuals and the obligations of organisations entrusted with confidential information.

The privacy framework governing AI platforms demonstrates that a private conversation is not necessarily an exclusively controlled conversation.

Other users cannot ordinarily access private chats. OpenAI states that it does not sell users’ conversations to advertisers. However, authorised personnel and service providers may access information in specified circumstances, and the use of submitted content for model improvement depends on the account type and applicable privacy settings.

For Nigerian lawyers, the implications extend beyond the platform’s privacy policy.

The Nigeria Data Protection Act 2023, the Constitution, the Evidence Act and the Rules of Professional Conduct for Legal Practitioners impose obligations that must be considered when client information is processed through external AI systems.

The fact that an AI platform is secure does not automatically resolve every issue of confidentiality, privilege or lawful data processing.

Equally, the existence of privacy risks does not justify rejecting artificial intelligence altogether.

The challenge is to adopt AI responsibly, with appropriate technical safeguards, contractual protections, internal policies and professional oversight.

For law firms, the guiding principle should be clear:

Artificial intelligence may assist a lawyer in performing professional duties, but it cannot assume or diminish the lawyer’s responsibility to protect the client’s interests and confidential information.

The future of legal practice will undoubtedly involve greater reliance on AI. The firms best positioned to benefit from this transformation will be those that recognise that technological innovation and professional responsibility must advance together.

Principal legal and policy references

The following primary materials should be consulted when publishing or updating this article:

1. OpenAI Privacy Policy – privacy, collection, processing, retention and disclosure. [1]
2. OpenAI: How We Handle Data in Consumer Services – authorised access, consumer data and model improvement.
3. OpenAI Business Data Privacy and Security – business and enterprise data commitments.
4. Rules of Professional Conduct for Legal Practitioners 2023 – particularly Rule 19. [4]
5. Evidence Act, Section 192 – professional communications between client and legal practitioner. [3]
6. Nigeria Data Protection Act 2023. [2]
7. Nigeria Data Protection Commission FAQs – including cross-border data transfers. [2]
8. OpenAI Chat and File Retention Policy.